Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
Analysis ID:1367834
MD5:aae3eedbdc1b1a99f7c2844f85352692
SHA1:8025c689f73816e6c275e38002649d91244d6db2
SHA256:2c1d65f58f07ad391492f0c0b1c335321f7b0d6e9f41218e04404e7b58692ddb
Tags:exe
Infos:

Detection

Score:54
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:17
Range:0 - 100

Signatures

Yara detected AntiVM3
Contains functionality to infect the boot sector
Creates an undocumented autostart registry key
Flash file may contain encrypted javascript
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
DLL planting / hijacking vulnerabilities found
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe (PID: 6196 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe MD5: AAE3EEDBDC1B1A99F7C2844F85352692)
    • regsvr32.exe (PID: 3668 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 5692 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 2076 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • 360TopbarASS.exe (PID: 3176 cmdline: "C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe" MD5: DEC58427DAFCCF050DA9AC893E28407C)
    • regsvr32.exe (PID: 3668 cmdline: "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 4508 cmdline: "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 6784 cmdline: "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 5380 cmdline: /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
    • GBInst.exe (PID: 4072 cmdline: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S MD5: 32DC2FA6DB8B8809B12A8CAD215C69FD)
    • 360wpappInstaller_zhuomian.exe (PID: 5884 cmdline: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian MD5: 02C91D3BE856789E1711C37649F382CC)
    • flashApp.exe (PID: 5004 cmdline: "C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe" onlyimport MD5: 28580334E670277D005E38D4C9E65CFD)
    • 360DesktopSwitch64.exe (PID: 4764 cmdline: "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe" /unloaddtswitcher MD5: 476B86E7D05550919702E25541927DA5)
    • regsvr32.exe (PID: 5808 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
      • regsvr32.exe (PID: 1984 cmdline: /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
    • regsvr32.exe (PID: 5256 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
    • regsvr32.exe (PID: 432 cmdline: "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
  • explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
    • 360TopBar.exe (PID: 2860 cmdline: "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun MD5: B70E8845A3DFB674910975E6D0C061EC)
    • WerFault.exe (PID: 6968 cmdline: C:\Windows\system32\WerFault.exe -u -p 1028 -s 10624 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • explorer.exe (PID: 1784 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
    • WerFault.exe (PID: 5012 cmdline: C:\Windows\system32\WerFault.exe -u -p 1784 -s 4932 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • explorer.exe (PID: 6668 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.exeJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    Process Memory Space: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe PID: 6196JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C3210 CryptCATAdminReleaseContext,15_2_021C3210
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C3230 CreateFileW,LocalAlloc,LocalAlloc,LocalFree,CryptCATAdminCalcHashFromFileHandle,GetLastError,LocalFree,LocalAlloc,CloseHandle,15_2_021C3230
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C3560 lstrlenA,MultiByteToWideChar,WinVerifyTrust,WTHelperProvDataFromStateData,WTHelperGetProvSignerFromChain,WTHelperGetProvCertFromChain,CertGetNameStringA,WinVerifyTrust,lstrlenA,MultiByteToWideChar,CryptCATAdminEnumCatalogFromHash,CryptCATAdminReleaseCatalogContext,LocalFree,15_2_021C3560
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C37D0 CryptCATAdminAcquireContext,CryptCATAdminEnumCatalogFromHash,CryptCATAdminReleaseCatalogContext,LocalFree,15_2_021C37D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C36E990 CryptBinaryToStringA,16_2_6C36E990
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37A460 CryptDestroyHash,16_2_6C37A460
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37A440 CryptDestroyKey,16_2_6C37A440
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C36E6C0 CryptBinaryToStringA,_memmove_s,_memcpy_s,16_2_6C36E6C0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3BA7A4 _LocaleUpdate::_LocaleUpdate,_strlen,CryptBinaryToStringA,_strlen,16_2_6C3BA7A4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37A030 CryptReleaseContext,16_2_6C37A030
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37E090 CryptGetHashParam,16_2_6C37E090
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37A120 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,_memset,lstrcpynA,CryptImportKey,CryptCreateHash,CryptSetHashParam,CryptHashData,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,16_2_6C37A120
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37A320 CryptGetHashParam,CryptGetHashParam,CryptGetHashParam,16_2_6C37A320
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3D3420 CertOpenStore,CryptMsgOpenToDecode,CryptMsgUpdate,CertCloseStore,CryptMsgClose,16_2_6C3D3420
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C393560 CryptUnprotectData,16_2_6C393560
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3932A0 CryptProtectData,LocalFree,16_2_6C3932A0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C393360 CryptUnprotectData,16_2_6C393360
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C36B380 CryptBinaryToStringA,CryptBinaryToStringA,CryptBinaryToStringA,16_2_6C36B380
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3F13E0 CryptDestroyKey,16_2_6C3F13E0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: LINKINFO.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: MSIMG32.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\PDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: profapi.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: MSASN1.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: srvcli.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: VERSION.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\7z.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: cscapi.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\safelive.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: WININET.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: NETAPI32.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: Cabinet.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360P2SP.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: DEVRTL.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: netutils.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: IPHLPAPI.DLLJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: edputil.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: iertutil.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: urlmon.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360net.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: Wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: TextShaping.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\360verify.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360verify.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeEXE: regsvr32.exeJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Uninstall.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exe

      Compliance

      barindex
      DLL planting / hijacking vulnerabilities found
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: LINKINFO.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: MSIMG32.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\PDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: profapi.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: MSASN1.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: srvcli.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: VERSION.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\7z.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: cscapi.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\safelive.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: WININET.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: NETAPI32.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: Cabinet.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360P2SP.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: DEVRTL.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: netutils.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: IPHLPAPI.DLLJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: edputil.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: iertutil.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: urlmon.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360net.dll
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: Wldp.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDLL: TextShaping.dllJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDLL: C:\Users\user\AppData\Roaming\360bizhi\360verify.dll
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDLL: C:\Users\user\AppData\Local\360GameBox\360verify.dll
      EXE planting / hijacking vulnerabilities found
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeEXE: regsvr32.exeJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Uninstall.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEXE: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeEXE: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exe
      Uses 32bit PE files
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      PE / OLE file has a valid certificate
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: certificate valid
      Contains modern PE file flags such as dynamic base (ASLR) or NX
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Binary contains paths to debug symbols
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdbNB10k source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb`` source: GBInst.exe, 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: e:\build\360DeskTop\UiFeatureControlSrc\UiFeature\Src\Pdb\UiFeature360Control.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B050000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2509212496.000000000357C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\shell360dt64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2558990791.00007FF8B8CEB000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdbNB10K source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebframe.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\Bin\360DeskTop\Release\BizPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8pJ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\shell360ext.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360NetUL\bin\360NetUL.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2497316206.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DesktopUi.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdbt source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTNotify.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb5 source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2501426282.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360MsgPushCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2482042900.00000000005A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdbx source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2482042900.00000000005A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DTSwitchBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Work\360se\extension2010\ExtNetIncrement\Output\ExtNetIncrement.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\desktoptool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb0` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb\Al source: flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SetupUtilDT.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\DownDll\Release\LiveUpd360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\AppcenterDataGb.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdbXp\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebbrowser.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Net_2\Release\360net.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2487820669.00000000005C8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdbh source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2507348840.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBoxCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\360TopBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000002.2612965104.0000000000219000.00000002.00000001.01000000.0000001D.sdmp, 360TopBar.exe, 00000016.00000000.2548217131.0000000000219000.00000002.00000001.01000000.0000001D.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb``y source: GBInst.exe, 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\dtappcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\CloudTaskCenter_naive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360AppCenter.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006BF2000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\BoxUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_1.4.0.1085_20110902\bin\360DeskTop\Release\RegSMWebProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdbL source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\UiPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppUpdate.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360Apns.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360weibo.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdbxQJ source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\360Down\Release\LiveUpdate360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Ver.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2608003325.0000000003C54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008E93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2485680529.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdbP source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTCrashReport.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2499422068.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\somcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429415030.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtfilm.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SomSoftMgrdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somQuickInstdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Desktop.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\svn\360desktop\branches\2.0.0.1120_201207016_B\Output\Bin\Release\SoftMgrLiteBase.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097C5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTFence.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdbp source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\Release\360wallpaper\version\DTCrashReport.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb`` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Desktop_20120814_2.3Release_appcore\bin\360DeskTop\Release\360AppCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000003.2610280460.00000000030E1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\flashApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2479671082.0000000002CE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000000.2482543383.00000000001F4000.00000002.00000001.01000000.00000010.sdmp, flashApp.exe, 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\code_svn\360SoftMgr\branches\GameMaster_1125_for_360dt\Output\Bin\Release\AppCenterCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2507348840.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360FeedBack\Release\360FeedBack.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Login\Release\oauthlogin.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\360GbApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\DTQuickInstProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdbH source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\PDown\Release\PDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490747591.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\Safelive\ReleaseUMinDependency\Safelive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2492077094.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\bin\Release\MiniUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2406322166.0000000000AD5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047064905.000000000377D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2611106336.0000000000AD5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2456398831.0000000003DC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047343657.0000000003DE8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2274600628.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2052214824.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2501426282.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somkernldt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\UpdateTool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360DesktopSetup\360TopbarASS\Release\360TopbarASS.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 00000007.00000000.2447871998.0000000000B08000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb source: GBInst.exe, 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmp, GBInst.exe, 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: e:\360DeskTop_2.2.0.1070_20120618\bin\360DeskTop\Release\MsgBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000095D4000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8pw source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429415030.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppcenterData.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\360GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\MusicIEFrame.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\02.WINDOWS\01.MyWork\01.UiFeature\01.SvnKing\trunk\KernelVersionCompany\Bin\Release\UiFeatureKernel.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2511568800.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,13_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00405D3A FindFirstFileA,FindClose,13_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00402630 FindFirstFileA,13_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,15_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00405D3A FindFirstFileA,FindClose,15_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00402630 FindFirstFileA,15_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C34EF80 _memset,_memset,PathAddBackslashW,FindFirstFileW,_memset,PathAddBackslashW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,16_2_6C34EF80
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppDataJump to behavior
      Source: Joe Sandbox ViewIP Address: 171.8.167.89 171.8.167.89
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=6648 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29968 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24957 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=13209 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1772 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23407 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7933&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=37062&r2=15793 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=17067 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=18640 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=18640 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=13322 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=8772 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=30407 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=20906 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23355&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=105189&r2=24629 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=25445 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=10282 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=474 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24763 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24865&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=152251&r2=26191 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=26498 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=16128 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=4740 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22292&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=179645&r2=23925 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24539 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=26734 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=20600 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29172&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=203246&r2=29887 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=30243 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=10129 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=11343 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21499&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=228113&r2=22263 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22619 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1538 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23630 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7395&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=254324&r2=9077 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=9384 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22394 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=15343 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AE8060 InternetReadFile,7_2_00AE8060
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=6648 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29968 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24957 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=13209 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1772 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23407 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7933&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=37062&r2=15793 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=17067 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=18640 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=18640 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=13322 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=8772 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=30407 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=20906 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23355&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=105189&r2=24629 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=25445 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=10282 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=474 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24763 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24865&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=152251&r2=26191 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=26498 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=16128 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=4740 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22292&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=179645&r2=23925 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24539 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=26734 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=20600 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29172&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=203246&r2=29887 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=30243 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=10129 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=11343 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21499&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=228113&r2=22263 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22619 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1538 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23630 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7395&r3=1280x1024 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=254324&r2=9077 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=9384 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0Host: s.360.cnUser-Agent: NSISDL/1.2 (Mozilla)Accept: */*
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22394 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=15343 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
      Source: unknownDNS traffic detected: queries for: s.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ftp://https://.org.net.com.net.cn.com.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s/%s.trt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s/%u%u.html
      Source: flashApp.exeString found in binary or memory: http://%s/api.php?
      Source: flashApp.exeString found in binary or memory: http://%s/checkpwc.php
      Source: flashApp.exeString found in binary or memory: http://%s/intf.php
      Source: flashApp.exeString found in binary or memory: http://%s/intf.php?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://%s?https://%s?&from=parad=login.360.cnhttp://%s/intf.php?https://%s/intf.php?method=UserIntf.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2507348840.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1/%s;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1/%sfilename=resourcesfilesmetalink:/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://agd.p.360.cnSOFTWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.go108.cn/360zm/json/astro_everyday/day/Horoscope:%dlovecareer
      Source: flashApp.exeString found in binary or memory: http://api.qcloud.360.cn/intf.php
      Source: flashApp.exeString found in binary or memory: http://api.renren.com/restserver.do
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://api.renren.com/restserver.do%utinyurlWWW-Authenticate
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.doSV
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.doSVW
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.renren.com/restserver.doU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/account/verify_credentials.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/account/verify_credentials.json?U
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/oauth/access_token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/oauth/access_token?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/statuses/update.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.163.com/statuses/upload.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/%s/%s/members.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/%s/lists/%s/statuses.xmlper_pagehttp://api.t.sina.com.cn/statuses/user_time
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/account/verify_credentials.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/account/verify_credentials.xml?source=U
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/favorites.xmlhttps://api.weibo.com/2/favorites.jsonfavorites
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/friendships/create.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://api.t.sina.com.cn/friendships/create/%s.json?source=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/friendships/show.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://api.t.sina.com.cn/oauth/access_token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://api.t.sina.com.cn/oauth/access_tokenhttp://api.t.sina.com.cn/users/show/%s.json?source=%shttp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/shortUrl.xmlurl_shorttypeurl_longhttp://api.t.sina.com.cn/friendships/creat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/counts.xmlhttps://api.weibo.com/2/statuses/count.jsoncountrtrepost
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/followers.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/friends.xmlhttps://api.weibo.com/2/friendships/friends.jsonnext_cu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/friends_timeline.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/mentions.xmlhttps://api.weibo.com/2/statuses/mentions.jsonhttps://
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/repost.xmlhttps://api.weibo.com/2/statuses/repost.jsonid=&status=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/update.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/update.xmlU
      Source: flashApp.exeString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xmlU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xmlhttp://api.t.sina.com.cn/statuses/update.xmlhttps://api.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://api.t.sina.com.cn/statuses/upload.xmlstatus&oauth_signatureOAuth
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/users/show.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.t.sina.com.cn/users/show.xmlhttps://api.weibo.com/2/users/show.jsoncmttypemention_status2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://api.t.sina.com.cn/users/show/%s.json?source=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://auto.search.msn.comGIF89a
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.360.cn/5473920.htmlCPictureGridPicker::ScrollTo:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.360safe.com/forum-883-1.htmlhttp://weibo.com/360gamebox%s?action=mgbosskey&state=%d&from=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000071FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.360safe.com/forum.php?mod=forumdisplay&fid=118&tj=pczhuomian360FeedBack.xmlSoftware
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.ioage.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bbs.ioage.com/cn/forum-33-1.html
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bdmbdr//dr/%d_%d_%d.jpg%d_%d_%d_%dmuti_desc%d_%dspecial_%d_%d/bdm/%d_%d_%dclass_idurl_thumb31
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bizhi.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000000.2482543383.00000000001F4000.00000002.00000001.01000000.00000010.sdmp, flashApp.exe, 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://bizhi.360.cn/
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bizhi.360.cn/#360
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bizhi.360.cn/uploadwallpaper.html360
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007A7B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bsalsa.com/
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000071FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://care.help.360.cn/care/uploadverifytagsys
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdata.browser.360.cn/api.php?a=switch&m=set&stamp=%s&sign=%s&qt=%s&app=%s&status=%sExt-Data;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=Ad&a=show&appid=%lu&m=%s&modulever=%s&appver=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=AppRelate&a=showList&appid=%lu&mid=%s&modulever=%s&appver=%s&bd=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getAppStatus&dtver=%s&mid=%sversion%lu%%3A%s%%2Capps=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getInfoByAppid&appid=%s&display_column=utag
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getListByTag&cid=%lu&page=%lu&sort=%s&tag=%s&ver=v2htt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getPresetUpdateApps%shttp://cdn.apc.360.cn/index.php?c
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientApp&a=getRecommendApps2&appid=%d&mid=%s&dtver=%s&mode=%dhttp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=ClientClass&a=getList&ver=v2http://cdn.apc.360.cn/index.php?c=Clie
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dGameDownloadResultLaunchGame
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dopenMobileMgrisMobileMgrExistis360SafeE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dyingyongdianjihttp://stat.apc.360safe.c
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=getEvent&qid=%s&event=%s84D988A6-79F3-3360-01CN-BE29SDES
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBox&a=getTimeTamptimefix/w
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=GameBoxClient&a=championNotice&qid=%sapp_namerival_name
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=VideoScreen&a=getPlayInfo&appid=%utitlesrc_allplay_titles
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WallPaper&a=getAppsByTagsFromCategory&from=360desktop&cids=%d&tags
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WallPaper&a=getAppsInfoByIds&ids=%sDownloadFavoriteProcess
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WebApp&a=show&appid=%lu&from=360dtclosesuccrawUrlloginedUrl%st
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.apc.360.cn/index.php?c=WebApp&a=show&appid=%lu&from=360dtsuccrawUrlloginedUrlweb
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.weather.hao.360.cn/sed_api_weather_info.php?app=desktop&fmt=json&code=%darea(%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cdn.weather.hao.360.cn/sed_api_weather_info.php?app=safeDestop&fmt=json&code=%shttp://weather
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://chrome.360.cn/pdown://h3=60
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://client.apc.360.cn/cms/360dtconf.inid
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cloud.openapi.360.cncookie_qcookie_t/app/add_list?uid=%s&ver=1.0Content-Type:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cmsg.browser.360.cn/api.php?qt=Get
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489590698.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteCodeSigningCA.crl0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489590698.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
      Source: explorer.exe, 00000014.00000000.2501641218.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2585762632.0000000000F13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dapp.wan.360.cn/360desk/mhxx?scrol=no&height=&r=1328833800D
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://data.weibo.com/top/topic?t=hourU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://desk.score.svc.1360.com/get?qid=%s&sign=%sLoginBallShowCountLoginGuideShowLLoginGuideShowHGui
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://desk.score.svc.1360.com/incr?event=%s&qid=%s&value=%d&sign=%s%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://desktop.360.cn/update/update.nxdbupdate.nxdb.newupdate.xdb.new
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dl.360safe.com/softmupdate/onekeyinstall.cabpdown://http://dlleak.360safe.com/leak/ty/hcphotf
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dlleak6.360safe.com/leak/winxp/123456.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/gamebox/android/360gamebox.apkDlg.ConnectPopuphttp://stat.apc.360safe.com/ms
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://down.360safe.com/safesetup_2000.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490747591.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllPath
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllPathopen
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllSOFTWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2492077094.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllopen
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://down.360safe.com/setup.exeSOFTWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exeentry
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097C5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047064905.000000000377D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047343657.0000000003DE8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2456398831.0000000003DAC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490747591.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe8
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeH
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040411849.0000000000777000.00000008.00000001.01000000.00000003.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2492077094.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeN
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000071FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exehttp://down.360safe.com/setup.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/downchrome.inichromeconfigurl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/downchrome.inichromeconfigurl360webapp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/mini_installer.exedownloadpdown://h3=60
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://down.360safe.com/zhuomian/setup.exeUpdateApplicationsAppDownloadCloseUpdateNewUpdateApplicati
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://errsug.se.360.cn/ch.html?m=%s&v=%s&qt=%s&qid=%s&n=%s&mn=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fastmm.sourceforge.net).
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gamebox.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gamebox.360.cn360yxhezi13a22fc0a
      Source: flashApp.exeString found in binary or memory: http://graph.renren.com/oauth/token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://graph.renren.com/oauth/tokenhttps://graph.renren.com/oauth/tokenrenren
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://graph.renren.com/renren_api/session_key?oauth_token=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hd.360.cn/angrybirds/http://static.apc.360.cn/cms/olympics/game_winner.html/page=%d
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hd.360.cn/baobei&ids
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007211000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.360.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://https://DecodePNGimg_reader.dll%s.uiz~mytmpimage_file_%srb
      Source: flashApp.exeString found in binary or memory: http://i.360.cn/findpwd/?src=%s&mid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://i.360.cn/profile/index2927http://i.360.cn/profile/chusername
      Source: flashApp.exeString found in binary or memory: http://i.360.cn/reg?src=%s&mid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://i.360.cn/reg?src=%s&mid=%shttp://i.360.cn/findpwd/?src=%s&mid=%sEDITLISTBOXD
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://i3.feixin.10086.cn/%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/appmenugouwu.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menubagua.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menulicai.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menushenghuo.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menushipin.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menutupian.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuxitong.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyinyue.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyo
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyouxi.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.360.cn/images/webapp/logo1223/menuyuedu.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/05/shame_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/0c/sw_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/0c/ws_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/13/sweat.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/17/ldln_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/19/hate.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/1b/gz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/1b/m_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/29/bz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/33/camera_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/40/come_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/40/cool_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/41/zz2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/46/zxc_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/48/sx_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/4b/paoxiao_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/4d/crazy.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/57/angry.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/58/mb_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/58/pig.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/5c/yw_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/60/horse2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/64/cafe_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/64/hs_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6a/cake.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6a/laugh.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6d/heart.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6d/zhh_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6e/panda_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/70/vw_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/71/bs2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/73/wq_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7d/sleep_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7e/hei_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7e/love.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/81/rabbit_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/88/zgl_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/89/nm_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/8b/sleepy.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/8f/qq_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/90/money_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/91/d_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/98/yhh_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/9c/tz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/9e/t_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/a4/dizzy.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/a6/x_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/af/cry.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/af/kl_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b6/kbs_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b6/sb_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b8/cz_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b8/green_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/b9/moon.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bc/fuyun_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bc/otm_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bd/cheer.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c2/tooth.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c7/no_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c9/geili_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/ca/chunnuanhuakai_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d0/z2_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d3/clock_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d6/ok_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d8/good_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d8/sad.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d8/sad_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d9/ye_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/e5/sun.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/e9/sk_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/ea/unheart.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/eb/smile.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f2/wg_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f3/k_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f4/cj_thumb.gif
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://intf.soft.360.cn/index.php?c=Search&a=getSoftList&cver=v1&kw=%S&soft_ids=%s&%s%d-baoku%d-%sCS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://intf.zsall.mobilem.360.cn/intf/checkMobile?para=%s%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://intf.zsall.mobilem.360.cn/zsintf/getDownloadUrl?soft_ids=%s&market_id=&appver=%s&uid=%s&pid=%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.org/license
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/cgi/pin.php?r=%d&p=%sSV
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/member/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/member/getpwd/getpwd0.php?entry=ssoS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/sso/getalt.php?entry=weibo360plugin&service=weibo360plugin&tgt=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/sso/login.php?entry=weibo360plugin&alt=%s&url=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://login.sina.com.cn/sso/prelogin.php?entry=weibo360plugin
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.openapi.360.cn/msg/check?session=%s&msgid=%s3A6539ADE038ACD6DBFA8A4D130E34A5
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.openapi.360.cn/usr/login
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.openapi.360.cn/usr/loginnickname:cookie:??unp=%s&un=%s&unp=%s&un=%shttp://profile.openapi.3
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://m.soft.360.cn/index.php?controller=Intf&action=get.Down.Url&soft_id=%d&no_view=1&ofmt=xml&%sh
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007A7B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mail.163.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mail.S
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://monitoring.openapi.360.cn/desktop/nopen/id/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://my.360.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://news.baike.360.cn/fw/zt1/heixiazi.htmlhttp://bbs.360safe.com/forum-162-1.html
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
      Source: explorer.exe, 00000014.00000002.2596015892.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.geotrust.com0K
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489590698.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://open.app.360.cn/?from=360desktop_tray%stype=open&action=appcenter&from=youxiajiaotray&TrayMen
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://open.app.360.cn/?from=360desktop_trayhttp://bbs.360.cn/5473920.htmlTaskbarCreatedhW
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p1.qhimg.com/t01300a29501effb80d.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p17.qhimg.com/t01786e375a7830d753.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p17.qhimg.com/t01f55a00a83c723f3d.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p19.qhimg.com/t01008d7e105188efac.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p2.qhimg.com/t016ca463057d8d4362.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p2s.f.360.cn/urlquery
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p5.qhimg.com/t019530ea43ea4d8d90.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p7.qhimg.com/t0187051ceab8c8d55c.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p8.qhimg.com/t011dbc6e088968ddd8.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p9.qhimg.com/t013736ff668d0555d4.png)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pdown.stat.360safe.com/dimana.htm&usetime=%d&downrate=%d&downlen=%I64u=&?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/360haohua/safe_chaoqiang.cab
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/gamebox/GBUpdateConfig_Manual.ini?tick=%lu..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/DtUpdateConfig_Manual.ini?tick=%dUpdateContentAttributeDownloadMainVers
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/DtUpdateConfig_Manual.ini?tick=%dhttp://pinst.360.cn/zhuomian/DtUpdateC
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/reinst_beta.cab/URL:http://pinst.360.cn/zhuomian/reinst_final.cabmodule
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.56.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.ku6.com/refer/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.pptv.com/v/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://player.youku.com/player.php/sid/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/degree.html#tab=2#uhp=%s#un=%shttp://profile.openapi.360.cn/user/info.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/degree.html#uhp=%s#un=%shttp://profile.openapi.360.cn/msg/info.html?ve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/user/info.html?un=dockbar
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.openapi.360.cn/user/popup.htmlGS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://profile.se.360.cn/proxyerr.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pstat.p.360.cn/uplog.php0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pstat.p.360.cn/uplog.phpinfo0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_download_url.php?type=download_url&soft_ids=%s&%sOptions
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_polls.php?mid=%Shttp://q.soft.360.cn/get_polls.php?ofmt=json&mid=%Shttp://q
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_update_info.php?type=update_info&soft_ids=%s&lrtime=0&%snameubrief2vdisppti
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://q.soft.360.cn/get_update_info.php?type=update_info&soft_ids=%s&lrtime=0&%subrief2vdispptimesu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://reg.163.com/getpasswd/RetakePassword.jsp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://reg.163.com/reg/reg.jsp
      Source: 360TopbarASS.exeString found in binary or memory: http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 00000007.00000000.2447871998.0000000000B08000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=&count=16&show=1&version=catecidrela
      Source: 360TopbarASS.exe, 00000007.00000002.2455270046.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 00000007.00000002.2455270046.0000000000F2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=59cd53708ed730f0ef42bb01f668d936&cou
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://res.qhupdate.com/wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini%d.%dB:A:downloadpat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://rm.api.weibo.com/statuses/unread.xml
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhibox&from=2
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhiexit&from=4startfrom=4http://s.360.cn/bizhi/s.html?action=b
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=0&fangshi=2http://s.360.cn/bizhi/s.html?acti
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=0http://static.apc.360.cn/cms/guajian.htmlHi
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=7http://s.360.cn/bizhi/s.html?action=bizhiri
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=8
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhirightlist&from=9dataimg_%d_%dtotal0errnogoodwallpaper.jsonh
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhiset&from=0&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=bizhiset&from=1&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?%sfun=lifecycle&act=updatedownload&res=app
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?%sfun=lifecycle&act=updateopen&res=app
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?%sfun=link&act=%s&res=%s&r1=%s&r2=%s&r3=%s&wjj
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=%s&fun=%s&act=%d&res=%d&mid=%s&ver=%s&r1=%d&r2=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2406322166.0000000000A9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=59cd53708ed730f0ef42bb01f668d936&ver
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2610717046.00000000035B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2459215204.000000000359F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2129177521.0000000003582000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/s.htm?pidu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/tray.htm?m=%s&uid=%s&pid=%s&appver=%s&modulever=%s%u.%u.%u.%uName
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/dt/tray.htm?m=%s&uid=%s&pid=%s&appver=%s&modulever=%shttp://m.openapi.360.cn/status.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360.cn/xiaoguanjia/xgj.html%s?action=shutdown&from=%d&appver=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s0.qhimg.com/lib/jquery/171.js
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s0.qhimg.com/st.360.cn/;bk_up;style/7e995a0e.css
      Source: explorer.exe, 00000014.00000000.2510896073.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.2512903417.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000002.2593631457.0000000008890000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sd.p.360.cn/%s.trt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sd.p.360.cn/BB53D19C9D32290AC8A94E902D7CB0C86A7E01E1.trt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://se.360.cnU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seapp.stat.360safe.com/q.html?name=%s&appver=%s&mid=%s&c=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seapp.stat.360safe.com/ver.html?name=%s&p=%s&mid=%s&fa=%s&fb=%s&fc=%sU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://setpass.app.se.360.cn/forget?type=mail
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2507348840.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seupdate.360safe.com/360webmail_ver2.ini%s%d.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seupdate.360safe.com/360webmail_ver2.ini?%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://seupdate.360safe.com/360webmail_ver2.ini?%dSV
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sizzlejs.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://soft.360.cn/static/ess/class_lenovo.xml?t=%d&%shttp://soft.360.cn/static/ess/class_6_0.xml?t=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=onekeyinstall&softid=%u&succ=%d&update=%d&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=onekeyinstall&softid=%u&succ=%d&update=%d&0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=open&action=%s&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=web&action=time&htime=%d&etime=%d&u=%s&ie=%s&bug=%lu&%%%about:bl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?type=web&action=time&htime=%d&etime=%d&u=%s&ie=%s&bug=%lu&%%%mshtml.d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?xml=err&m=~DF
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.360safe.com/stat/?xml=err&m=~DFP.ScriptTypeScript..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360deskup2m.cab10222201102021020621221110210213208218206204209203205
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360deskup2m.cab360AppCore%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360gamebox/v3update.cab?src=%S&t=%d&%Supdate.ini360safe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://softm.update.360safe.com/360gamebox/v3update.cab?src=360DtMgr&t=%d&%shttp://softm.update.360s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.360safe.com/360/?stype=changeskin&ver=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429415030.0000000003FE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stat.360safe.com/360safeurl/?type=upnet&mid=%sFloating
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://stat.360safe.com/login.html?type=login&from=%s&action=%s&style=%s&uid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://stat.360safe.com/login.html?type=login_checksumfail&q_send=%s&vt_send=%d&q_recv=%s&vt_recv=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/ad.html?action=slidetimeout&appid=%lu&%stype=new&action=webapp-cpu&from=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/ad.html?action=slidetimeout&appid=%lu&UiFeature360CtrlAnimationBalloonWndClsA
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=dakaizhuce&%stype=new&action=zhuce&from=%s&r1=%s&ap
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=msgbox&from=%d&detail=%d&m=%s&modulever=%s&appver=%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=msgboxweibo&from=%s&detail=%s&uid=%s&pid=%s&m=%s&mo
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=runmsg&from=full&detail=run&m=%s&modulever=%s&appve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=runmsg&from=full&detail=run&open_msgbox360ID
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/msg.html?type=open&action=zhucechenggong&360DesktopRegisterVerifyCodeDlg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html%s?type=open&action=%s&mod=%d&appid=%lu&fenleiid=%d&from=%d&style=fu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%dx%d%stype=new&action=newdtmusic&from=%d&appid=&0http://stat.apc.3
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=moviefunction&from=%d&fangshi=&sort=&r1=&%stype=n
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=newdtmusic&from=%d&appid=&bad
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=openfiles&from=%d&r1=fences&r2=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=performanceindex_button&from=%u&fangshi=%u&safeve
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=new&action=tipsclick&from=%d&fangshi=%d&sort=&r1=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006BF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=open&action=appcenter&style=fullscreen&from=%d&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?%stype=open&action=yingyongdianji&mod=1&fangshi=%d&appid=%d&fenleii
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=SetAppwallpaper&from=1&fangshi=&appid=&r1=&r2=&r3=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=SetSyswallpaper&from=0&fangshi=&appid=&r1=&r2=&r3=&
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=bizhibubble&from=1LastCloudIdSoftware
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=bizhibubble&from=4http://stat.apc.360.cn/stat.html?
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=bizhilunbo&from=%d&fangshi=%d&appid=%s&r1=&r2=&r3=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007211000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=feedback&from=%d&fangshi=%d&uid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendar&from=1&fangshi=1&r1=fences&r2=particu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendar&from=1&fangshi=2&r1=fences&r2=particu
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendar&from=6&r1=fences&r2=particular&http:/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=genghuanbizhishezhi&from=1&fangshi=&http://stat.apc
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=genghuanbizhishezhi&from=2&fangshi=&CCapDeviceChang
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=gerenzhongxin&from=%d&mid=%s&uid=%sA3B6B07CF749024E
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=guanbiruanjian&from=&fangshi=&sort=&r1=&
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=msgremind&from=%d&appid=%s&http://stat.apc.360.cn/s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=1&uid=1&pid=h_home&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=3&uid=1&pid=h_home&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=1&uid=1&pid=h_home&m=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=startinstall&appver=%s&r1=%s&uid=1&pid=%s&m=%shttp:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2459215204.000000000359F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=startinstall&appver=2.6.0.1110&r1=2.6.0.1110&uid=1&
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=wpcommon&from=00
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000000.2482543383.00000000001F4000.00000002.00000001.01000000.00000010.sdmp, flashApp.exe, 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=zidaiyingyong&from=7&fangshi=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=2&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newbuttonclick&from=4&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=1000&uid=1&pid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=2&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=3&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=new&action=newdetailclick&from=4&uid=1&pid=h_h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=anzhuanganquanzhuomian&from=3&mod=%d&appver=%s&pac
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2459215204.000000000359F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=anzhuanganquanzhuomian&from=3&mod=1&appver=2.6.0.1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=anzhuangyunxing&from=%d&appver=%s&packagever=%s&ui
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=bengkuilesorry&deskbanben=%s&deakbanhao=%s&t=%dMoz
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2499422068.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=bengkuilesorry&deskbanben=%s&deakbanhao=%s&t=%dfee
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=guanbicomputer&-reboothttp://stat.apc.360.cn/stat.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=guanbisuoyouruanjian&%shttp://stat.apc.360.cn/stat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=qieping&from=1&style=%d&PageMyAppFS.xml%windir%
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=sequence&from=%d&r1=fences&%stype=new&action=xinji
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=shengjichengxu&from=1&http://stat.apc.360.cn/stat.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2610717046.00000000035B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=tiyanjihua&from=1&appver=2.6.0.1110&packagever=2.6
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=update&360DTNotifyF3C85C74-71B1-4ac8-9C89-B9BE4DC4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/stat.html?type=open&action=detailclick&from=1&uid=1&pid=h_hom
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000003.2610280460.00000000030E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/tmp.html%s?action=gj_appcore&from=1%s?action=gj_appcore&from=2&fangshi=%u&sor
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360.cn/webapp.html?%stype=webapp&action=error&appID=%d&host=%s&errorcode=%d&errortyp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html%s?action=%s&sid=%u&moduledownokmoduleinstallokmodulenoninstallT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html%s?action=%s&sid=%u&moduledownokmoduleinstallokmodulenoninstalld
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2501426282.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html%s?action=mgpopup&from=4&detail=1003&state=1&x
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?360Gbapp..
      Source: GBInst.exe, 0000000D.00000002.2548302754.000000000056B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?action=mginst&state=
      Source: GBInst.exe, 0000000D.00000002.2548302754.00000000005D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?action=mginst&state=1&pid=ZMSilent&m=59cd53708ed730f0ef42bb01f6
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?action=mgpopup&from=4&detail=2001&state=%d&x
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.apc.360safe.com/msg.html?http://stat.apc.360.cn/stat.html?%stype=open&action=somxmlLoadR
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stat.ioage.com/web/theworld2up.ini?2.4.1.9needfileSUBVER_%slanguages
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006BF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/apphotweb.htmlsysMaxtooltips_class32dcGP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/ertong/ertongleyuan.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/ertong/ertongleyuan.htmlhttp://static.apc.360.cn/cms/music/tingyinyue.h
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/gamecomment.html?appid=%d&from=%dwebapp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/education.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/fashion.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/female.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/game.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/investment.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/life.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/magzine.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/music.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/news.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/novel.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/picture.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/shopping.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/social.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/tools.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/mini/video.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/minivideo/index.htmlAnimImage
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/minivideo/noplayer.html360Desktop
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/minivideo/player.html?playUrl=%sspliter1spliter2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/music/tingyinyue.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B050000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2509212496.000000000357C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/novels/gcy.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B050000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2509212496.000000000357C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/novels/gcy.htmliBookMenu.Yahei.NormaliBookMenu.Yahei.Hover
      Source: GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/recommend_game_new.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/selected.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/selected.htmlhttp://client.apc.360.cn/cms/360dtconf.ini7
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/skin_uploadwebapp.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/theme/index.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/theme/index.htmlMusicIEFrame7
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/video/shipinhezi1.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/video/shipinhezi1.html%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/video/videoNew.html?context=%s&num=%s&count=%d
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/bztuijian.htmlhttp://s.360.cn/bizhi/s.html?action=bizhirightl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/show.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/show.phpTextSinaWeibo_CJPicLD_BeginTimeLD_EndTimebutton
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/weibo-share.html
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper/weiboshare.html#
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/wallpaper_feedback.htmlloopwallpaper.xml&r1=1&action=bizhiEntrance&from
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/cms/xiaoxihezi/tankuang.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/feedback/index.html?appid=%d&name=%s360WebappLead2ArenaTipsClass360WebappGa
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/feedback/index.html?appid=%d&name=%swebgamecontrolpanel.xml360Desktop
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://static.apc.360.cn/other/app_center/app_poll_1_0.htmlSoftMgr_Notify
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/360GameBoxConf.xmlGameBox_ConnectingMobilePopup
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/popup/pop_bg.pngmap/set
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/rules.htmhttp://swf.baoku.360.cn/gamebox/exaward.htmhttp://swf.baoku
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htmI360AppCenterDataClientTypeTabVisible
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htmSettingCenter
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/gamebox/sorryjump.htmpdown://h3=30
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/Sound.zipStartDownload()
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/flashActiveX.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/flashActiveX.exe&..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/hzx/flashActiveX.exehttp://swf.baoku.360.cn/hzx/Flash32_11_3_win8_360.ocx..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/douban.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/jingfm.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t.163.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t.cn/Swi4kM
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://t.cn/htzkKX
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://theworld.cn/http://ioage.com/http://www.ioage.com/Update
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tp3.sinaimg.cn/1751401422/50/5611920854/1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tuan.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tuan.360.cn/api/se2.php?rc=%d&fromid=%d
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://uninstall.feedback.360.cn/360desktopuninstall.html?ver=%s&mid=%s&safever=%s&sysver=%s&is64=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://up.soft.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://up.soft.360.cnQuickInstLog0.0.0.0/index.php?c=Upload&a=upload&pjt=quickinst&ver=%s&mid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=1101&status=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=1101&status=25&change=local&mid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=1101&status=25&change=self&mid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000071FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/instcomp.htm?soft=2300&status=%d%02xshell32.dllPrivateExtractIconsWuser32.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/v3/safeup_lib64.cabhttp://update.360safe.com/v3/safeup_lib.cab360trayHandl
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://update.360safe.com/zhuomian/music/SelectMusicConfig.xml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v.ifeng.com/include/exterior.swf?guid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.cnzz.com/c.php?id=30000496
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/Shopping.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/bagua.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/licai.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/shenghuo3.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/xitonggongju.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/yinyue.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/youxi3.png
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://w.qhimg.com/images/v2/webapp/class/20110519/yuedu.png
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAllCategoriesV2http://cdn.apc.360.cn/index.ph
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsByCategory&cid=%s&start=%d&count=%dhttp:/
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsByTagsFromCategory&cids=%s&start=%d&count
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsInfoByIds&ids=%s-995OpenSettingCenterDoOp
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsV3&cids=%s&start=%d&count=%dhttp://wallpa
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaperAloneRelease&a=qrcodeshow&url=%shttp://wallpaper.ap
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cn/index.php?c=WallPaperAloneRelease&a=srvhoverUpdateFinish
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wallpaper.apc.360.cnjson_err/index.php?c=WallPaper&a=apiCrashReportbizhi.dump.360.cndump/uplo
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/bbs.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/bbs.htmlgame.360.cn&name=http://wan.360.cn/bbs/second.html?g=%shttp://wan.360.cnn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/cs
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wan.360.cn/csgame.360.cn&name=http://wan.360.cn/bbs/second.html?g=%shttps://KeFuhttp://wan.36
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/fans
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profile
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileS
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileSVW
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileSf
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/%d/profileU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/atme
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/comments
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/messages?source=toptray
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/signup/signup.php?entry=360se
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/signup/signup.php?ps=u3&lang=zh
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/signup/signup.php?ps=u3&lang=zhU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://weibo.com/zt/s?k=
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://whttp://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsInfoByIds
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wpad.%s/wpad.dathttp://%s/wpad.datwpad
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097C5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047217526.000000000320E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2608003325.0000000003C54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000095D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008E93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.000000000359F000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2495238781.000000000357E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2497316206.0000000003586000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2497052860.0000000003580000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490747591.0000000003571000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002BDE000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487364268.0000000002CC0000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2484431607.0000000002CB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn//index.html127.0.0.1--
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/ConnectedState:%dCreateFile
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/custom/xukexieyi.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/privacy/index.htmlJoinExperiencePlan%stype=setting&action=tiyanshezhi&shezhi=%d&SO
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/shoujizhushou/index.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/sinaweibo.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/ucenter/faq.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/userexperienceimprovement.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/weishi/index.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/weishi/index.htmlres://%d/%s/%dDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/xukexieyi.html#zhuomianJ
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn/yinsichengnuo.html#xiangqing23
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cn;color=rgb(60
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cnMAINFRAME
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2508252090.000000000054E000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360.cnPublisher360
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360safe.com360o
      Source: explorer.exe, 00000014.00000000.2522719212.000000000C860000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2607456987.000000000C860000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/baidu?word=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/baidu?word=%us&tn=ichuner_4_pg&ie=utf-8:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/index.php?tn=ichuner_2_pg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/s?tn=ichuner_4_pg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/s?wd=%shttp://www.google.com.hk/search?q=%s&client=aff-os-prius&hl=zh-CN&ie=gb2
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.geotrust.com/resources/cps0(
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.go108.com.cn/openapp/360app/astrofate/result.php?iAstro=%dA3B6B07CF749024E2DB5A6DF0DF37D1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cn/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=javascri
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cn/search?client=aff-worldbrowser&channel=errorpage&forid=1&ie=utf-8&oe=UTF-8&hl=z
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=%s&i
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=%us:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/search?q=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.hk/webhp?client=aff-worldbrowser&ie=utf-8&oe=UTF-8&hl=zh-CN
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ifeng.com&fromweb=other&AutoPlay=false
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.indyproject.org/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/help-appendix-04.htmhttp://www.theworld.cn/http://www.ioage.com/cn/help.htmT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/help-shortcut.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/help.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/index.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/plugins.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/skin.htmPA
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/cn/thanks.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/browsemode.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/dailytips.ini$http://www.ioage.com/web/navierr.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/hl/cn/rendermode.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/frame_naverror.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/inst.htmhttp://www.ioage.com/web/uninst.htmUpgrade
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/navierrres:about:blank%s/Software
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/web_search_cn.htm
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ioage.com/web/welcome_cn.htm?ver=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.macromedia.com/go/getflashplayer
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.meilishuo.com/users/register
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mogujie.com/register
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.planeart.cn/?p=1121
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.renren.com/md5LoginU
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/sogou?query=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theworld.cn/client/downhttp://www.theworld.cn/client/up
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.theworld.cn/client/syncfavsorder.db%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tudou.com/v/
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll-1.2.3rbr
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllincompatible
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000095D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllrbr
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yinyuetai.com/video/player/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://you.video.sina.com.cn/api/sinawebApi/outplayrefer.php/vid=
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhifu.openapi.360.cnMode
      Source: explorer.exe, 00000014.00000002.2609003981.000000000CA11000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/00C91DA8863D472fB1873585577810F1
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/360chromeinstalltips.html
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/360chromeinstalltips.html$
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ShowAppPermitDlg
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/f&TCopyright
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exeString found in binary or memory: http://zhuomian.360.cn/ver2.0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000003.2610280460.00000000030E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0/
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000002.2612965104.0000000000219000.00000002.00000001.01000000.0000001D.sdmp, 360TopBar.exe, 00000016.00000000.2548217131.0000000000219000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0/reboot360DTSwitchBar.dllRunDLL
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0C:
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0L
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0SetUnhandledExceptionFilterkernel32.dllGIF89a
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0Shell_TrayWnd
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0kernel32.dll360BoxCtrlCScrollMutliAppbox360DockBarCtrl360Desktop_CNBSug
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0kernel32.dllSetUnhandledExceptionFilteropenDTCrashReport.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0processinfo.dat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006BF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0somkernldt.dll..
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cn/ver2.0widthheightcallbackoncloseHWND=%lu;content=%sHWND=;content=T
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnLocalSt
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://zhuomian.360.cnReferertokenautologinerrno=vector
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://zhuomian.360.cnSwitchBar.xmlupdatecfg.inimodules
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnap
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cne
      Source: explorer.exe, 00000014.00000000.2503114639.0000000003040000.00000002.00000001.00040000.00000017.sdmpString found in binary or memory: http://zhuomian.360.cnhttp://zhuomian.360.cnhttp://zhuomian.360.cn360
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnobat
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zhuomian.360.cnsomkernldt.dll..
      Source: flashApp.exeString found in binary or memory: https://%s/intf.php?
      Source: explorer.exe, 00000014.00000000.2521483480.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2605360530.000000000C4DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
      Source: explorer.exe, 00000014.00000000.2507675469.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2590375486.00000000076F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2596015892.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
      Source: explorer.exe, 00000014.00000000.2507675469.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2590375486.0000000007637000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://api.weibo.com/2/friendships/create.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/friendships/followers.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/friendships/show.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/friends_timeline.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/update.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/upload.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/statuses/upload.jsonaccess_token1.jpgpic
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/2/users/show.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://api.weibo.com/2/users/show.json?access_token=%s&uid=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/oauth2/U
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2497052860.0000000003580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.weibo.com/oauth2/authorize?client_id=3977697501&redirect_uri=https%3A%2F%2Fconnect.360.c
      Source: explorer.exe, 00000014.00000000.2504115554.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2588015796.00000000035FA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.coml
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdata.browser.360.cn/api.php?https://cdata.browser.360.cn/api.phpvtversiontype
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://connect.360.cn/index.php?U
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feixin.10086.cn/account/register/CC_DelAccountResult
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp, flashApp.exeString found in binary or memory: https://graph.renren.com/oauth/token
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://graph.renren.com/transfer?%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://graph.renren.com/transfer?%slogout
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2497052860.0000000003580000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.feixin.10086.cn/https://i2.feixin.10086.cn/https://i3.feixin.10086.cn/https://i5.feixin.10
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://i2.feixin.10086.cn/api/user.json?access_token=%s
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://i2.feixin.10086.cn/api/user.json?access_token=%shttp://api.qcloud.360.cn/intf.phperror_descr
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2129191265.0000000003562000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2166209779.0000000003562000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.sina.com.cn/sso/login.php
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openapi.360.cn/internal/get_is_user_paid.json?q=%s&t=%spaynotify.xmlpaynotify_del.xmlheadima
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openapi.360.cn/internal/get_user_by_q_t.json?%sapp_key=%s&q=%s&t=%s&type=%d&name=%sD
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openapi.360.cn/internal/get_user_by_q_t.json?%sapp_key=%s&q=%s&t=%s&type=%d&name=%shttp://cd
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://passport.360.cn/api.php?parad=http://passport.360.cn/api.php?parad=&from=360deskmethod=UserI
      Source: explorer.exe, 00000014.00000002.2605360530.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2521483480.000000000C460000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcember
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rm.api.weibo.com/2/remind/unread_count.json
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://spreadsheets.google.com/http://spreadsheets.google.com/https://docs.google.com/http://docs.g
      Source: explorer.exe, 00000014.00000002.2596015892.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/)s
      Source: explorer.exe, 00000014.00000002.2596015892.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comon
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwwhttp://wwwTW.2.10%d:
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00404F1F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,13_2_00404F1F
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37A120 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,_memset,lstrcpynA,CryptImportKey,CryptCreateHash,CryptSetHashParam,CryptHashData,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,16_2_6C37A120
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AEF080: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle,7_2_00AEF080
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,13_2_00403225
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,15_2_00403225
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A6690_3_0341A669
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A6690_3_0341A669
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A9380_3_0341A938
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A9380_3_0341A938
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A6690_3_0341A669
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A6690_3_0341A669
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A9380_3_0341A938
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0341A9380_3_0341A938
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034BA94E0_3_034BA94E
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034BA94E0_3_034BA94E
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347CBCA0_3_0347CBCA
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034863D80_3_034863D8
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034863D80_3_034863D8
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347FFE90_3_0347FFE9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348260F0_3_0348260F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347BE960_3_0347BE96
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347BC120_3_0347BC12
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347D99D0_3_0347D99D
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347D7A70_3_0347D7A7
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034849A00_3_034849A0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034849A00_3_034849A0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034BA94E0_3_034BA94E
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034BA94E0_3_034BA94E
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347CBCA0_3_0347CBCA
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034863D80_3_034863D8
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034863D80_3_034863D8
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347FFE90_3_0347FFE9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348260F0_3_0348260F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347BE960_3_0347BE96
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347BC120_3_0347BC12
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347D99D0_3_0347D99D
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347D7A70_3_0347D7A7
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034849A00_3_034849A0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034849A00_3_034849A0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D88F0_3_0348D88F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D5180_3_0348D518
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D88F0_3_0348D88F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D5180_3_0348D518
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D88F0_3_0348D88F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D5180_3_0348D518
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034923F90_3_034923F9
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489E880_3_03489E88
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897090_3_03489709
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D88F0_3_0348D88F
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A180_3_03488A18
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0348D5180_3_0348D518
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034916390_3_03491639
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03489A310_3_03489A31
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034897B10_3_034897B1
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA1470_3_034AA147
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A9F010_3_034A9F01
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C0_3_034A6A9C
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A61AE0_3_034A61AE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA4220_3_034AA422
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034924100_3_03492410
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034924100_3_03492410
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034924100_3_03492410
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B040837_2_00B04083
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AE30707_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF01907_2_00AF0190
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B02A8E7_2_00B02A8E
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF6A327_2_00AF6A32
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFEB277_2_00AFEB27
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFE3477_2_00AFE347
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B056E87_2_00B056E8
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFDE727_2_00AFDE72
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFB7AE7_2_00AFB7AE
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF0FE07_2_00AF0FE0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B02FD27_2_00B02FD2
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFE71B7_2_00AFE71B
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFEF477_2_00AFEF47
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_3_037B6B4813_3_037B6B48
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_3_037B14F013_3_037B14F0
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_3_037BB0B013_3_037BB0B0
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0040600A13_2_0040600A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0040473013_2_00404730
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0378FF5F13_2_0378FF5F
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_03790B9B13_2_03790B9B
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0378FA1B13_2_0378FA1B
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0378168013_2_03781680
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0378A84513_2_0378A845
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_037918FC13_2_037918FC
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_037904A313_2_037904A3
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_0040600A15_2_0040600A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_0040473015_2_00404730
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021CB0B015_2_021CB0B0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C14F015_2_021C14F0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C6B4815_2_021C6B48
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001DE6D016_2_001DE6D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001DE15016_2_001DE150
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001F199216_2_001F1992
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001E119016_2_001E1190
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001F138916_2_001F1389
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001F1CB016_2_001F1CB0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001F0E4516_2_001F0E45
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001D8E7016_2_001D8E70
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001D16A016_2_001D16A0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001ED73816_2_001ED738
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001E674116_2_001E6741
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C37148016_2_6C371480
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3E4C1816_2_6C3E4C18
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3AEDF016_2_6C3AEDF0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3DEDD916_2_6C3DEDD9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3DEDC016_2_6C3DEDC0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B2EF016_2_6C3B2EF0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B8F3016_2_6C3B8F30
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B6A8016_2_6C3B6A80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C380B8016_2_6C380B80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3E65B516_2_6C3E65B5
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3D063016_2_6C3D0630
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C35861016_2_6C358610
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3E46D416_2_6C3E46D4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3CC71416_2_6C3CC714
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3660D016_2_6C3660D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C35425016_2_6C354250
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3CC2F416_2_6C3CC2F4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C38239016_2_6C382390
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3663E016_2_6C3663E0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C373D8016_2_6C373D80
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3CBEE816_2_6C3CBEE8
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3E1EC316_2_6C3E1EC3
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3E585416_2_6C3E5854
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3D990016_2_6C3D9900
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3C1A5016_2_6C3C1A50
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3CBB1416_2_6C3CBB14
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C363BD016_2_6C363BD0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C357BC016_2_6C357BC0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C38350016_2_6C383500
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3CB63F16_2_6C3CB63F
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B708016_2_6C3B7080
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3E515C16_2_6C3E515C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B729016_2_6C3B7290
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CE75BC20_2_00007FF8B8CE75BC
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CD49F020_2_00007FF8B8CD49F0
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CE3E6820_2_00007FF8B8CE3E68
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CDAFA020_2_00007FF8B8CDAFA0
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CDF36020_2_00007FF8B8CDF360
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CE132C20_2_00007FF8B8CE132C
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CDE72C20_2_00007FF8B8CDE72C
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CD389020_2_00007FF8B8CD3890
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CE60B020_2_00007FF8B8CE60B0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00206AA022_2_00206AA0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00215BF522_2_00215BF5
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_0020F7FB22_2_0020F7FB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE240026_2_00007FF680AE2400
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AF5DEC26_2_00007FF680AF5DEC
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE21A026_2_00007FF680AE21A0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE199026_2_00007FF680AE1990
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE62D026_2_00007FF680AE62D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AEEB0C26_2_00007FF680AEEB0C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AF3B0426_2_00007FF680AF3B04
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE4EB026_2_00007FF680AE4EB0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE67E026_2_00007FF680AE67E0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AED7F826_2_00007FF680AED7F8
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AEFF9026_2_00007FF680AEFF90
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AF10B826_2_00007FF680AF10B8
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AF3D2826_2_00007FF680AF3D28
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AEB44C26_2_00007FF680AEB44C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE7C4026_2_00007FF680AE7C40
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AF20B026_2_00007FF680AF20B0
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: String function: 03789F4C appears 34 times
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: String function: 00AF6FF8 appears 42 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C354240 appears 124 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 001E4094 appears 48 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C3D1A70 appears 50 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C3D1B90 appears 39 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C3B8655 appears 36 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C349710 appears 31 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C347530 appears 37 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C3D1B50 appears 83 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C3BC28C appears 58 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: String function: 6C3B1210 appears 146 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: String function: 00007FF680AE79D0 appears 32 times
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: String function: 0020A0AC appears 37 times
      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1028 -s 10624
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: DLL type: 7-zip archive data, version 0.4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 213427 bytes, 1 file, at 0x2c +A "7z.dll", number 1, 12 datablocks, 0x1 compression
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: OEMDATA type: 7-zip archive data, version 0.3
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: SETUPCONFIG type: 7-zip archive data, version 0.4
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Resource name: SKIN type: 7-zip archive data, version 0.4
      Source: 360mwapp.exe.0.drStatic PE information: Resource name: RT_RCDATA type: COM executable for DOS
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
      Source: 360weibo.exe.0.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
      Source: Uninstall.exe.0.drStatic PE information: Resource name: OEMDATA type: 7-zip archive data, version 0.3
      Source: Uninstall.exe.0.drStatic PE information: Resource name: SKIN type: 7-zip archive data, version 0.4
      Source: 360seNotify.exe.0.drStatic PE information: Number of sections : 12 > 10
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\017TCWeiBoEditForm\016CWeiBoEditForm\013BorderStyle\007\006bsNone\007Caption\022\005'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\030TCWeiboPuzzlePicEditForm\027CWeiboPuzzlePicEditForm\013BorderStyle\007\006bsNone\007Caption\006\027CWeiboPuzzlePicEditForm\014ClientHeight\003"\001\013ClientWi'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\030TCWeiboPuzzlePicItemForm\027CWeiboPuzzlePicItemForm\013BorderStyle\007\006bsNone\007Caption\006\027CWeiboPuzzlePicItemForm\014ClientHeight\003\014\001\013ClientWi'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\027TMsgBoxClientAnchorForm\026MsgBoxClientAnchorForm\013BorderStyle\007\006bsNone\007Caption\022'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TRemindItemBasicForm\023RemindItemBasicForm\013BorderStyle\007\006bsNone\007Caption\006\023RemindItemBasicForm\014ClientHeight\003\027\001\013ClientWidth\003\346\001\005Color'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TShareImgPreviewForm\023ShareImgPreviewForm\013BorderStyle\007\006bsNone\013BorderWidth\002\001\007Caption\022\004'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TShareLoginBasicForm\023ShareLoginBasicForm\013BorderStyle\007\006bsNone\007Caption\006\023ShareLoginBasicForm\014ClientHeight\003\320'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\032TShareSendResultAnchorForm\031ShareSendResultAnchorForm\013BorderStyle\007\006bsNone\007Caption\006\031ShareSendResultAnchorForm\014ClientHeight\003\320'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\024TSinaSsoLoginingForm\023SinaSsoLoginingForm\013BorderStyle\007\006bsNone\007Caption\024\011'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\022TUfClientBasicForm\021UfClientBasicForm\013BorderStyle\007\006bsNone\007Caption\006\021UfClientBasicForm\014ClientHeight\003\027\001\013ClientWidth\003\262\001\005Color\004\361\366\371'
      Source: 360seNotify.exe.0.drStatic PE information: Resource name: RT_RCDATA type: Delphi compiled form '\021TUfTodayTopicForm\020UfTodayTopicForm\013BorderStyle\007\006bsNone\007Caption\022\004'
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7za.dll, vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUpdateTool.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Apns.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppcenterDataGb.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDTCrashReport.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtfilm.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesomkernldt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesomQuickInstdt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007211000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360FeedBack.exe vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSoftMgrLiteBase.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Common.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopAssistant.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopMenu.DLL0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopUi.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007A7B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename30seNotify.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlproc.DLL vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlprocnet.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B050000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeature360Control.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2608003325.0000000003C54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Ver.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLiveUpdate360.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMusicIEFrame.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWebLogin.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRegSMWebProxy.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSetupUtilDT.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSpecialBuildProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSetup.exe8 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000095D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMsgBox.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameScreen.exe, vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedesktoptool.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047064905.000000000377D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360GbApp.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360ZMUDetail.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTFence.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008E93000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Ver.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeatureKernel.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiPluginCake.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2479671082.0000000002CE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameflashApp.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDTShutdown.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtswitcher.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameRegularSutdown.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360weibo.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360net.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360NetUL.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeatureKernel.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiPluginCake.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDTQuickInstProxy.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtwebbrowser.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: F\VarFileInfo\Translation000%x\StringFileInfo\%s\OriginalFileName%sSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe%u.%u.%u.%u\deepscan\cloudsec2.dllDSAsyncEvaluateExechttp://stat.apc.360.cn/tmp.html%s?action=gj_appcore&from=1%s?action=gj_appcore&from=2&fangshi=%u&sort=%uroconfig.iniAppCoreNotDelayQuitappUser32.dllChangeWindowMessageFilterhttp://softm.update.360safe.com/360appupdate.cab vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360AppCo.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Desktop.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2680877982.0000000002CE9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Common.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2485680529.0000000002CE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Ver.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: SSpecialBuildProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTSwitchBar.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSpecialBuildProductVersionProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047343657.0000000003DE8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360GameBox.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSpecialBuildProductVersionProductNamePrivateBuildOriginalFilenameLegalTrademarksLegalCopyrightInternalNameFileVersionFileDescriptionCompanyNameCommentsHr,g vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSafelive.DLL0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppCenterCore.dll@ vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Verify.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell360ext.dll> vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSMWebProxydt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDown360Notify.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePDown.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameimg_reader.dll6 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLiveUpd360.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Inst.exe vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360mwapp.exe vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CA3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360Login.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGameBox.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGameBoxCore.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360TopBar.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360TopbarASS.exe: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360wapp.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2456398831.0000000003DAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlproc.DLL vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlprocnet.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDumpReport.rc2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameflashApp.exe2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360P2SP.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2042755839.0000000002858000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename7za.dll, vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429415030.0000000003FE0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameurlprocnet.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009116000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppcenterData.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360MsgPushCore.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTPreview.EXE: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSomSoftMgrdt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUiFeature360Control.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360seNotify.rs" vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtswitcher.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtwebframe.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameExtNetIncrement.dll2 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006CF6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360AppCenter.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2453646464.00000000035B5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360TopbarASS.exe: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesomcoredt.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAppUpdate.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBizPluginCake.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBoxUI.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2049153799.0000000002859000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiniUI.dll vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCloudTaskCenter_naive.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \JudgeVersionc:\test\xLogConfig.ini..\xLogConfig.inilogfilter360DesktoplogDirName\Logs.logAppCenterData.dllCreateAppCenterIPCMgr\VarFileInfo\Translation000%x\StringFileInfo\%s\OriginalFileName%sSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe\deepscan\bapi.dll360Topbar.exe360AppCore.exe"%s" /autorunSOFTWARE\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Run/autorun360DesktopMainProg%s\*.*...find_first_file error [%d] vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedtappcore.dll0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DesktopSwitch.exe: vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename360DTNot.exe0 vs SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: 360seNotify.exe.0.drStatic PE information: Section: .reloc IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      Source: classification engineClassification label: mal54.evad.winEXE@27/1337@43/2
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3D1230 SetLastError,GetLastError,SetLastError,GetLastError,_wcsrchr,_wcsncpy,_strerror,MultiByteToWideChar,_wcsncpy,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,FormatMessageW,_wcstok,_vswprintf_s,_wcsncpy,GetSystemTime,LocalFree,FreeLibrary,16_2_6C3D1230
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,13_2_00404275
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00201160 lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle,22_2_00201160
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00402012 CoCreateInstance,MultiByteToWideChar,13_2_00402012
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001DC1E0 LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,16_2_001DC1E0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\s[1].htmJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeMutant created: \Sessions\1\BaseNamedObjects\360DtUnInstaller
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeMutant created: \Sessions\1\BaseNamedObjects\Local\360_login_account_config_lock2
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 6196
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 2860
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4764
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5004
      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1028
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeMutant created: \Sessions\1\BaseNamedObjects\Local\360Login_mapping_lock
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeMutant created: \Sessions\1\BaseNamedObjects\DT_TOPBAR_{8AB1E186-A11B-476f-B8EB-83D0A6E5009E}
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeMutant created: \Sessions\1\BaseNamedObjects\360DtInstaller
      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1784
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeMutant created: \Sessions\1\BaseNamedObjects\360desktop_appcore
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{8BA98B53-011F-40a2-8B0C-D0C87CFC6457}.tmpJump to behavior
      Source: Yara matchFile source: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.exe, type: DROPPED
      Source: unknownProcess created: C:\Windows\explorer.exe
      Source: unknownProcess created: C:\Windows\explorer.exe
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cate7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: count7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: count7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cate7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cid7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: relate_type7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: cid7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: relate_type7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: zm_d7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: 100047_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: version7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: 1.07_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: encoding7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: UTF-87_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: standalone7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: child7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: book7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCommand line argument: \360Desktop7_2_00AE3070
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCommand line argument: RunDLL22_2_00201DF0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile read: C:\Users\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT aid , cid FROM customcategoryappmap;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT aid , cid FROM customcategoryappmap_cm;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT info FROM tempappinfos WHERE aid IN %s ;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT info FROM appinfos WHERE aid IN %s ;
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT aid , cid FROM customcategoryappmap_disneymode;
      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe "C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe "C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe" onlyimport
      Source: C:\Windows\explorer.exeProcess created: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1028 -s 10624
      Source: unknownProcess created: C:\Windows\explorer.exe explorer.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe" /unloaddtswitcher
      Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1784 -s 4932
      Source: unknownProcess created: C:\Windows\explorer.exe explorer.exe
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Windows\explorer.exeProcess created: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
      Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile written: C:\Program Files (x86)\360\360Desktop\updatecfg.iniJump to behavior
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: certificate valid
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic file information: File size 22004296 > 1048576
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdbNB10k source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb`` source: GBInst.exe, 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: e:\build\360DeskTop\UiFeatureControlSrc\UiFeature\Src\Pdb\UiFeature360Control.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B050000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2509212496.000000000357C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se3\trunk\extension\AppBase\wxsqlite3.7.2\bin\sqlite3.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\shell360dt64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2558990791.00007FF8B8CEB000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdbNB10K source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebframe.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\Bin\360DeskTop\Release\BizPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8pJ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\shell360ext.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360NetUL\bin\360NetUL.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2497316206.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DesktopUi.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdbt source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTNotify.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb5 source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2501426282.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360MsgPushCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2482042900.00000000005A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\7z_%209.20.0.1020_20120420_A\bin\Release\7z.pdbx source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2482042900.00000000005A9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360DTSwitchBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\Work\360se\extension2010\ExtNetIncrement\Output\ExtNetIncrement.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\desktoptool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb0` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: P:\intermoutput\3\360Login_ForDeskTop\Release\360Login.pdb\Al source: flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SetupUtilDT.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\DownDll\Release\LiveUpd360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\AppcenterDataGb.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000911E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2500257404.000000000358D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopSwitch.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdbXp\ source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtwebbrowser.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Net_2\Release\360net.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2487820669.00000000005C8000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdbh source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2507348840.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBoxCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\360TopBar.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000002.2612965104.0000000000219000.00000002.00000001.01000000.0000001D.sdmp, 360TopBar.exe, 00000016.00000000.2548217131.0000000000219000.00000002.00000001.01000000.0000001D.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher64.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb``y source: GBInst.exe, 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360Wapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\dtappcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtswitcher.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\CloudTaskCenter_naive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360AppCenter.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006BF2000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\BoxUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_1.4.0.1085_20110902\bin\360DeskTop\Release\RegSMWebProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\release\360wallpaper\version\360wpup.pdbL source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360DeskTop\src\Release\UiPluginCake.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppUpdate.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360Apns.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360weibo.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdbxQJ source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\360Down\Release\LiveUpdate360.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop_2.6.0.1080_20130226\bin\360DeskTop\Release\360DesktopAssistant.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Ver.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2608003325.0000000003C54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008E93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2485680529.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\SML_Shutdown_for_DT\Output\Bin\Release\RegularShutdown.pdbP source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\360desktop\360DeskTop\bin\360DeskTop\Release\360ZMUDetail.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTCrashReport.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2499422068.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\somcore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429415030.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\dtfilm.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SomSoftMgrdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somQuickInstdt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpsrv.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\360Desktop.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\360\svn\360desktop\branches\2.0.0.1120_201207016_B\Output\Bin\Release\SoftMgrLiteBase.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097C5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DTFence.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdbp source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper\bin\360desktop\Release\360wallpaper\version\DTCrashReport.pdb source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb`` source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\onlineinstaller\Release\360Inst.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Desktop_20120814_2.3Release_appcore\bin\360DeskTop\Release\360AppCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exe, 00000016.00000003.2610280460.00000000030E1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\flashApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2479671082.0000000002CE3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000083EE000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, 00000010.00000000.2482543383.00000000001F4000.00000002.00000001.01000000.00000010.sdmp, flashApp.exe, 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmp
      Source: Binary string: E:\build\360browser\src\DreamWork\TheWorld\TheWorld\TheWorld___Win32_Release_Unicode\360mwapp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\code_svn\360SoftMgr\branches\GameMaster_1125_for_360dt\Output\Bin\Release\AppCenterCore.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360se\360se3\trunk\extension_store\Down360seNotify\Release\NotifyDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2507348840.0000000003571000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\build\360FeedBack\Release\360FeedBack.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360Login\Release\oauthlogin.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\bin\360DeskTop\Release\360GbApp.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\DTQuickInstProxy.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360WallPaper_For_C++\bin\360desktop\Release\360wallpaper\version\360wpapp.pdbH source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\360DesktopMenu.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\build\360Pdown_3\PDown\Release\PDown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009647000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2490747591.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: E:\repos\urlproc_1.2.8\CheckedBuildWithPDB\urlproc.pdbX source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\Safelive\ReleaseUMinDependency\Safelive.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2492077094.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\bin\Release\MiniUI.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2406322166.0000000000AD5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047064905.000000000377D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2611106336.0000000000AD5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2456398831.0000000003DC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047343657.0000000003DE8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2274600628.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2052214824.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\src\Release\DTShutdown.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\SMWebProxydt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\build\360P2SP_2\360P2SP\Release\360P2SP.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2501426282.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\somkernldt.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\UpdateTool.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\360DesktopSetup\360TopbarASS\Release\360TopbarASS.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 00000007.00000000.2447871998.0000000000B08000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: e:\build\360GameBox_1.5.0.1040_20121119\bin\360DeskTop\Release\SetupHelperGB.pdb source: GBInst.exe, 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmp, GBInst.exe, 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmp
      Source: Binary string: e:\360DeskTop_2.2.0.1070_20120618\bin\360DeskTop\Release\MsgBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000095D4000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\PROJ\360DesktopSetup\360Setup_Work\Release\Setup.pdb8pw source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: E:\repos\urlprocnet_1.2.4\CheckedBuildWithPDB\urlprocnet.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009BA1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429415030.0000000003FE0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\AppcenterData.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000908A000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360GameBox\Bin\360DeskTop\Release\360GameBox.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: e:\build\360DeskTop\bin\360DeskTop\Release\MusicIEFrame.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: d:\02.WINDOWS\01.MyWork\01.UiFeature\01.SvnKing\trunk\KernelVersionCompany\Bin\Release\UiFeatureKernel.pdb source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2511568800.0000000003571000.00000004.00000020.00020000.00000000.sdmp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B0023C LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,7_2_00B0023C
      Source: 360seNotify.exe.0.drStatic PE information: section name: .didata
      Source: 360seNotify.exe.0.drStatic PE information: section name: QProtect
      Source: 360weibo.exe.0.drStatic PE information: section name: .share
      Source: DTCrashReport.exe.0.drStatic PE information: section name: .share
      Source: 360Common.dll.0.drStatic PE information: section name: history
      Source: 360MsgPushCore.dll.0.drStatic PE information: section name: .share
      Source: Safelive.dll.0.drStatic PE information: section name: .IShareO
      Source: Shell360dt.dll.0.drStatic PE information: section name: .orpc
      Source: Shell360dt64.dll.0.drStatic PE information: section name: .orpc
      Source: somkernldt.dll.0.drStatic PE information: section name: .data1
      Source: urlproc.dll.0.drStatic PE information: section name: .SHARE
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034191A8 push 88033709h; ret 0_3_034191AD
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034191A8 push 88033709h; ret 0_3_034191AD
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034191A8 push 88033709h; ret 0_3_034191AD
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034191A8 push 88033709h; ret 0_3_034191AD
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347B42B pushfd ; ret 0_3_0347B441
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_0347B42B pushfd ; ret 0_3_0347B441
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_03488A18 push ss; iretd 0_3_0348914A
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA147 pushfd ; iretd 0_3_034AA421
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA147 pushfd ; iretd 0_3_034AA421
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AA147 pushfd ; iretd 0_3_034AA421
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C push eax; ret 0_3_034A6E0D
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034A6A9C push eax; ret 0_3_034A6E0D
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AAD11 push ecx; retf 0_3_034AAD12
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeCode function: 0_3_034AAD11 push ecx; retf 0_3_034AAD12

      Persistence and Installation Behavior

      barindex
      Contains functionality to infect the boot sector
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d7_2_00AEF080
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d7_2_00AEF440
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d7_2_00AEF5D0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d15_2_021C2480
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d15_2_021C2300
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d15_2_021C1F40
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d16_2_6C3CF8D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d16_2_6C3CFA60
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d16_2_6C3CF510
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d22_2_00206360
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d22_2_002063C9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: malloc,SetLastError,CreateFileA,DeviceIoControl,CloseHandle,free, \\.\PhysicalDrive%d26_2_00007FF680AE5DD0
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\ExtNetIncrement.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTFence.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\BoxUI.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\MusicIEFrame.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\UpdateTool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360wapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SMWebProxydt.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360NetUL.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\DTShutdown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360Login.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\360GameBox.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\DumpReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppUpdate.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somkernldt.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\NSISdl.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\sqlite3.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\sqlite3.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MsgBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360AppCore.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtfilm.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360ZMUDetail.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\PDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360TopBar.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\LiveUpdate360.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UpdateTool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360weibo.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\oauthlogin.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SomSoftMgrdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\desktoptool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\NotifyDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360wpappInstaller_zhuomian.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GameBox.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtwebbrowser.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBox.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTSwitchBar.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BizPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Desktop.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\CatchScreenTray.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.rs (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\AppcenterDataGb.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\DumpReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Uninstall.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\Registry.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{CF943540-C2E3-43cc-9B55-E4222D53DF15}.tmp\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtfilm.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtwebbrowser.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopUi.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtappcore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\CloudTaskCenter_naive.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GbApp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtwebframe.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\RegularShutdown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\GBInst.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher64.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\360verify.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Shell360dt64.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360MsgPushCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ImportFavHelper.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360NetUL.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\AppcenterData.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\img_reader.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTShutdown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\CatchScreenTray.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtwebframe.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{7B893064-B4AE-4242-8CC3-858A8B4FE14C}.tmp\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360net.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\registry.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmpJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.rsJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Uninstall.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360verify.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360FeedBack.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Local\Temp\{9F0A4041-4B7E-48bb-8CA2-8C474BD03C91}.tmpJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\CloudTaskCenter_naive.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\PDown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\360verify.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Common.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\RegSMWebProxy.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360verify.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\NSISdl.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppCenterCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Shell360dt.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\ImportFavHelper.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360ZMUDetail.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\MsgBox.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\SetupHelperGB.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\safemon\urlprocnet.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\DTCrashReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\flashApp.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Users\user\AppData\Roaming\360Notify\Bin\360weibo.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DTSwitchBar.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\ExtNetIncrement.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBoxCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\LiveUpdate360.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\AppCenterCore.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SoftMgrLiteBase.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtswitcher.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MusicIEFrame.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopSwitch64.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\AppUpdate.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\System.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Apns.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360MsgPushCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\DTQuickInstProxy.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360TopbarASS.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppcenterData.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Login.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360dtpreview.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\desktoptool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTQuickInstProxy.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Ver.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\LiveUpd360.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\360mwapp.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360Inst.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360verify.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\modules\360Inst.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeFile created: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopAssistant.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtswitcher64.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360P2SP.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopSwitch.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\safemon\urlproc.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\RegSMWebProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360net.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360wapp.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\SetupUtilDT.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtappcore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\BizPluginCake.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopMenu.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\PDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\img_reader.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\360P2SP.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somQuickInstdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360AppCenter.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BoxUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile created: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile created: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.rsJump to dropped file

      Boot Survival

      barindex
      Contains functionality to infect the boot sector
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d7_2_00AEF080
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d7_2_00AEF440
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d7_2_00AEF5D0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d15_2_021C2480
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d15_2_021C2300
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: CreateFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d15_2_021C1F40
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d16_2_6C3CF8D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d16_2_6C3CFA60
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d16_2_6C3CF510
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d22_2_00206360
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d22_2_002063C9
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: malloc,SetLastError,CreateFileA,DeviceIoControl,CloseHandle,free, \\.\PhysicalDrive%d26_2_00007FF680AE5DD0
      Creates an undocumented autostart registry key
      Source: C:\Windows\System32\regsvr32.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\360DesktopExt NULL
      Source: C:\Windows\System32\regsvr32.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\360DesktopExt NULL
      Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeWindow found: window name: Progman

      Hooking and other Techniques for Hiding and Protection

      barindex
      Flash file may contain encrypted javascript
      Source: wallpaper-cm2.swf.0.drStatic Flash information: Found token: unescape in unescapeStringreadN
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C39C240 InvalidateRect,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,16_2_6C39C240
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C39C240 InvalidateRect,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,16_2_6C39C240
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C39B0D0 InvalidateRect,SetWindowPos,SetWindowPos,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,16_2_6C39B0D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C39B0D0 InvalidateRect,SetWindowPos,SetWindowPos,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,GetWindowRect,SetWindowPos,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,ShowWindow,16_2_6C39B0D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C39B320 IsWindow,IsWindowVisible,IsWindow,IsWindowVisible,IsWindow,IsWindowVisible,IsWindow,IsIconic,ShowWindow,ShowWindow,ShowWindow,BringWindowToTop,SetActiveWindow,SetForegroundWindow,16_2_6C39B320
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3D4040 LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetLastError,16_2_6C3D4040
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion

      barindex
      Yara detected AntiVM3
      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe PID: 6196, type: MEMORYSTR
      Query firmware table information (likely to detect VMs)
      Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
      Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SBIECTRL.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSNIFFER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\SBIECTRL.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WINDBG.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FIDDLER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EHSNIFFER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\WIRESHARK.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\FIDDLER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VSNIFFER.EXE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
      Source: C:\Windows\explorer.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 486
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{9F0A4041-4B7E-48bb-8CA2-8C474BD03C91}.tmpJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360FeedBack.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\ExtNetIncrement.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\PDown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\360wpup.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\CloudTaskCenter_naive.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTFence.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\BoxUI.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\MusicIEFrame.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Common.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\UpdateTool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360wapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\RegSMWebProxy.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppCenterCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Shell360dt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\DTShutdown.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\ImportFavHelper.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\360GameBox.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\DumpReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppUpdate.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somkernldt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360ZMUDetail.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\MsgBox.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\safemon\urlprocnet.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\DTCrashReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\sqlite3.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\sqlite3.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MsgBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\360weibo.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360AppCore.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtfilm.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360ZMUDetail.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\PDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\LiveUpdate360.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\ExtNetIncrement.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBoxCore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\LiveUpdate360.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\AppCenterCore.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UpdateTool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SoftMgrLiteBase.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360weibo.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtswitcher.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MusicIEFrame.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\oauthlogin.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SomSoftMgrdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\AppUpdate.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\desktoptool.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Apns.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Uninstall.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\DTQuickInstProxy.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\NotifyDown.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeatureKernel.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GameBox.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtwebbrowser.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppcenterData.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBox.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BizPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360dtpreview.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\desktoptool.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTQuickInstProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Desktop.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\CatchScreenTray.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiPluginCake.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Ver.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.rs (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\AppcenterDataGb.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\LiveUpd360.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\DumpReport.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Uninstall.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\360mwapp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{CF943540-C2E3-43cc-9B55-E4222D53DF15}.tmp\MiniUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtfilm.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360Inst.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\modules\360Inst.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtwebbrowser.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopAssistant.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtswitcher64.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopUi.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtappcore.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\CloudTaskCenter_naive.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360P2SP.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GbApp.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopSwitch.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtwebframe.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\safemon\urlproc.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\RegularShutdown.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher64.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\RegSMWebProxy.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360net.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360wapp.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ImportFavHelper.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\SetupUtilDT.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtappcore.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\BizPluginCake.dll (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\AppcenterData.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Safelive.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\img_reader.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTShutdown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\360P2SP.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\PDown.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\img_reader.dll (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\CatchScreenTray.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTCrashReport.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtwebframe.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somQuickInstdt.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{7B893064-B4AE-4242-8CC3-858A8B4FE14C}.tmp\7z.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360AppCenter.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360net.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)Jump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.rsJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GameBox.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BoxUI.dllJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)Jump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Uninstall.exeJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeDropped PE file which has not been started: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeature360Control.dllJump to dropped file
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeEvaded block: after key decision
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeEvasive API call chain: GetSystemTime,DecisionNodes
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleep
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_7-17197
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleep
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_13-11668
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
      Source: C:\Windows\explorer.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_13-11283
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeAPI coverage: 4.0 %
      Source: C:\Windows\explorer.exeAPI coverage: 0.6 %
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe TID: 6568Thread sleep count: 45 > 30
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: PhysicalDrive0Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeFile Volume queried: C:\ FullSizeInformation
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,13_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00405D3A FindFirstFileA,FindClose,13_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00402630 FindFirstFileA,13_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00405368 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,15_2_00405368
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00405D3A FindFirstFileA,FindClose,15_2_00405D3A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_00402630 FindFirstFileA,15_2_00402630
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C34EF80 _memset,_memset,PathAddBackslashW,FindFirstFileW,_memset,PathAddBackslashW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,16_2_6C34EF80
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\userJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeFile opened: C:\Users\user\AppDataJump to behavior
      Source: explorer.exe, 00000014.00000002.2590375486.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "Qemu Manager 6.0\Qemu Manager.lnk
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QemuManager.exe
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0r
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: explorer.exe, 00000014.00000002.2588015796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmware.exe
      Source: explorer.exe, 00000014.00000002.2585762632.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2166209779.000000000356D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2129191265.000000000356D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B2C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: GBInst.exe, 0000000D.00000003.2512653390.00000000005C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Qemu Manager 6.0\Qemu Manager.lnk
      Source: GBInst.exe, 0000000D.00000002.2548302754.00000000005A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
      Source: 360TopbarASS.exe, 00000007.00000002.2455270046.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2548302754.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000003.2505190629.000000000059A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GSoftware\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Workstation
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: BSoftware\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Player
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
      Source: explorer.exe, 00000014.00000002.2588015796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 d9 2e dc 89 72 dX
      Source: explorer.exe, 00000014.00000002.2590375486.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware\VMware Workstation.lnk
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000003.2497279919.000000000059A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllE
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware\VMware Player.lnk
      Source: explorer.exe, 00000014.00000002.2588015796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Software\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Workstation
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Software\Microsoft\Windows\CurrentVersion\Uninstall\VMware_Player
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU Manager
      Source: explorer.exe, 00000014.00000002.2588015796.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware,p
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Player
      Source: explorer.exe, 00000014.00000002.2585762632.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Workstation
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
      Source: explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}-
      Source: explorer.exe, 00000014.00000002.2590375486.000000000769A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeAPI call chain: ExitProcess graph end nodegraph_13-10914
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeAPI call chain: ExitProcess graph end nodegraph_13-11670
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeAPI call chain: ExitProcess graph end nodegraph_15-9872
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeAPI call chain: ExitProcess graph end nodegraph_15-11202
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeAPI call chain: ExitProcess graph end node
      Source: C:\Windows\explorer.exeAPI call chain: ExitProcess graph end node
      Source: C:\Windows\explorer.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeAPI call chain: ExitProcess graph end node
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeAPI call chain: ExitProcess graph end node
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Windows\explorer.exeProcess queried: DebugPort
      Source: C:\Windows\explorer.exeProcess queried: DebugPort
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF11FB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_00AF11FB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3D6530 GetCurrentThreadId,OpenThread,GetProcessHeap,OpenThread,GetLastError,GetProcessHeap,HeapFree,OutputDebugStringW,CloseHandle,16_2_6C3D6530
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B0023C LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,7_2_00B0023C
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00B04593 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,7_2_00B04593
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF11FB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_00AF11FB
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF294A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_00AF294A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AEEBA1 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_00AEEBA1
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AF0D52 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_00AF0D52
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFBEE8 SetUnhandledExceptionFilter,7_2_00AFBEE8
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0378579A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,13_2_0378579A
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_037865B2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,13_2_037865B2
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_0378CD95 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_0378CD95
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C965D SetUnhandledExceptionFilter,15_2_021C965D
      Source: C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exeCode function: 15_2_021C964B SetUnhandledExceptionFilter,15_2_021C964B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001E1970 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_001E1970
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001EC2F2 SetUnhandledExceptionFilter,16_2_001EC2F2
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001E1318 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_001E1318
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_001E46DB __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_001E46DB
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3BCC8B __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_6C3BCC8B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B8D36 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_6C3B8D36
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: 16_2_6C3B8660 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_6C3B8660
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CDD17C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,20_2_00007FF8B8CDD17C
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CDBC80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,20_2_00007FF8B8CDBC80
      Source: C:\Windows\explorer.exeCode function: 20_2_00007FF8B8CE5C6C RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_00007FF8B8CE5C6C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00201C00 lstrlenW,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,Sleep,CreateMutexW,GetLastError,SetUnhandledExceptionFilter,__set_invalid_parameter_handler,22_2_00201C00
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_0020997E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,22_2_0020997E
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00209241 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,22_2_00209241
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_0020E715 SetUnhandledExceptionFilter,22_2_0020E715
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00213F44 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,22_2_00213F44
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AEAD88 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,26_2_00007FF680AEAD88
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AF2EEC RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_00007FF680AF2EEC
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AED3F8 SetUnhandledExceptionFilter,26_2_00007FF680AED3F8
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: 26_2_00007FF680AE90D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,26_2_00007FF680AE90D0
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle, explorer.exe22_2_00201160
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle, explorer.exe22_2_00201160
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: lstrlenW,_memset,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,__wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle,CloseHandle, explorer.exe22_2_00201160
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: __wcsicoll,OpenProcess,CloseHandle,GetCurrentProcess,Process32NextW,CloseHandle, explorer.exe22_2_00201209
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll" Jump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll" Jump to behavior
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: 22_2_00201720 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,22_2_00201720
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /AddApp=%dProgmanWorkerW360DesktopFullScreenWndClass360DockBarCtrl\RegSMWebProxy.exe\360Desktopwait_for_fullscreen_show
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047064905.000000000377D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047343657.0000000003DE8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Shell_traywndP
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B087000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: http://zhuomian.360.cn/ver2.0Shell_TrayWnd\Welcome UiFeatureUiFeatureWindowUI_FEATURE_%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02Xfeaturewindowparaminvalid map/set<T> iteratormap/set<T> too long
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ANtCreateUserProcessntdll.dllNtCreateProcessExAppCenterData.dllCreateAppCenterIPCMgrC:*.*.."%s" %sProgmanSHELLDLL_DefViewWorkerWdt_webapp_browser_.lnkExplorerRunFiles (x86)%s\360gameusers%s\360Desktop%s\360desktop.ini%s\360GBsc.ini%s\360Dtsc.ini%s\Skin%s\MiniAppdata.xdb%s\UpgradeData.xdb%s\Config.ini%s\webapps.ini%s\Config.Xdb%s\Config.nxdb%s\HandlerDelFlag.ini%s\SoftMgr.db%s\SoftMgrCfg.db%s\DtUpdateConfig.ini%s\AppDataStorage.db%s\updateapptips.ini%s\SCDUP%s\import.fg%s\AppSCProc.ini#RELATIVE_PATH#%s\360Desktop\Image\Icon\Common\%s\InnerWeb\%s\clientsoftIDs.tmp%s\pushrecord.ini%s\w360_Weather.ini%s\Temp\%s\AdvMsg.xml%s\DtWebMailHost.nxdb%s\AdvMsgRecord.ini%s\schedule.ini%s\ChildeMode\%s\PswImg%s\DisneyMode\%s\Sound%s\360GameCenter.exe360GameBox.exe360GbApp.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndXMenuDragREBAR_GRIPStatusBarFFindBarFTabBarFPlugInBarFMiniBarFFavoriteBarFMenuBarFSearchBarFTabBarPlugInBarMiniBarMenuBarSearchBarStyleSideBarCurSelComboBoxBG_ADDRESSAdressLeftPadAdressRightPadBG_ADDRESSEDITAddressCYAddressBarMainCYBottomCornerMultiTabBrowser-Embedding%s:%sGlobalUserOfflineSoftware\Microsoft\Windows\CurrentVersion\Internet Settingshttp://www.ioage.com/cn/help-appendix-04.htmhttp://www.theworld.cn/http://www.ioage.com/cn/help.htmTWFORM.HTMStatusPluginKeyhttp://www.ioage.com/cn/guide/guide_start.htmhttp://www.ioage.com/wzhttp://bbs.ioage.comhtm400%200%150%130%50%70%30%%s&guid=%s&lastver=%s2.1.2.22.1.2.42.1.0.22.0.5.12.0.3.42.3.0.72.3.0.8Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN2.2.1.02.2.1.22.2.1.4ICON_ADD_FAVORITEStatusCYXFrame_Wnd-setupopenNAVIERR.HTM125%TheWorld.icotw:confhttp://www.google.com.hk/search?client=aff-cs-worldbrowser&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q=%s&ie=utf-8http://www.google.com.hk/search?q=&tn=ichunertn=baidu.com/baidu?baidu.com/shttps:http:
      Source: explorer.exe, 00000014.00000000.2502770667.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanSHELLDLL_DefViewWorkerWWinsta0\default" AdvApi32CreateProcessWithTokenWexplorer.exe360GameBox.exe360GbApp.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exe..\Uninstall.exe/SopenBin\360Desktop.exe..\360gamebox.exe/INSTALL/UNINSTALL/UNINSTFromSP/LowRunDeskTop/LowRunGameBox/ClearGBAppZip/SetLocalTime_vector<T> too longsomkernldt.dll..\somkernl.dllSomPluginbad allocation~{
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: JvR0kFstd::stringSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exeAppcenterData.dllCreateAppCenterDataInterface.fbak\MiniAppdata.xdb-journal%%%ProgMan..\360appcenter.exe-from 360desktop_new -startup 360loopwallpaper.exeWallPaper\wallpaper.swf WallPaper\wallpaper_cm.swf HideSuspWndUtil::APP::RunFlashApp() -enDesktopMode=%d -pszSwfPath=%sright_menu_wallpaper-swf "%s" -new %d -ver %d -from 360desktop_new -startup flashapp.exe%s StartByDesktopGloUtil::GetDownloadMgr()->CallFlashApp() -bRet=%dWALLPAPER\WALLPAPAER_NEW_TOTALCOUNTWALLPAPER\WALLPAPER_NOW_TOTALCOUNT%s%d\360kantu.exe360safe.exe360chrome.exe360se.exeabout:blank\SoftMgr\SoftManager.exehttp://www.360.cnMAINFRAME\HWND360Desktop\first_run_flag
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ech.txtShell_TrayWndReBarWindow32pastelinkpaste360desktop DropEffectcopycut%s\%s - oR,g%s%s\%s - oR,g (%d)%s360DestopNetDiskClipBoardKeyskin\deskmirror.uizDrawShadowTextLastResulotionycomctl32.dllx
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000093A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ccsUTF-8UTF-16LEUNICODEe+0001#QNAN1#INF1#IND1#SNAN\Fonts\msyh.ttfWorkerWProgmanSHELLDLL_DefView360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32_360DesktopSwitcherControlWnd_MsgOnly__360DesktopSwitcherControlWnd_MsgOnly_Wnd360DirectUICls_SwitchBar360DirectUICls360Desktop\ExecuteProFile.tmpfilepathexecuteparams
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IcustomUrl360Desktop\Image\Icon\Common\customUrl.png360Desktop\Image\Icon\Common\customUrl_64.png360Desktop\Image\Icon\Common\customUrl_72.pngdefAppIcon360Desktop\Image\Icon\Common\Default_48.png360Desktop\Image\Icon\Common\Default_64.png360Desktop\Image\Icon\Common\Default_72.pngappMask360Desktop\Image\Icon\Common\DefaultMask_48.png360Desktop\Image\Icon\Common\DefaultMask_64.png360Desktop\Image\Icon\Common\DefaultMask_72.png\UserChoice\ProgidHKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\HKCU\Software\Classes\HKCR\\shell\\command\httpSoftware\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE.lnk..\AppSCProc.iniExplorerRunFilesWorkerWSHELLDLL_DefViewFolderViewProgmanInternet Explorer_ServerGetNativeSystemInfo360DesktopSwitch64.exe360DesktopSwitch.exe"%s" %s360Desktop\ExecuteProFile.tmpfilepathexecuteparamsh
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Anametext360Desktop\Xml\Tools\DesktopToolAppCenterData.dllCreateAppCenterIPCMgrC:*.*..HibernateEnabledSYSTEM\CurrentControlSet\Control\PowerHeuristicsSYSTEM\CurrentControlSet\Control\Session Manager\Powerpowercfg.exe-h on-h off"%s" %s?dir?RES.exe.ICO.imeProgmanWorkerWHARDWARE\DESCRIPTION\System\CentralProcessor\0~MHzAMD4
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A..\C:/.dllProgmanWorkerWSeDebugPrivilegeListBkListSelBkDropBtnITEMcmdIdselectedImagesrcColorvalueBG_blockBG_imgBtn_blockBtn_imgBtn_heightTabBtnmsctls_hotkey32t
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WorkerWProgmanSHELLDLL_DefViewFolderViewSysListView32skin\images\topbar%s %s360Desktop.exe/fromtopbar /entertainment/fromtopbar /fence360DesktopFullScreenWndClassPathSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe\360wpsrv.exe\360wpapp.exeStartByDesktop StartFrom=4360WallPaperCtrlCls/pid=360zhuomian..\360yunpan\360WangPan.exe360AppCore.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exeSoftMgr\360AppCore.exe360desktop_appcore"%s"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe\Bin\AppCenterData.dllCreateAppCenterIPCMgr/fromtopbar /opensetting/fromtopbar /checkupdateURL="%s"explorer.exe\..\360Desktop.exe%d.%d.%d.%d/fromtopbar %s360Lhb
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Fidinfoexec..params.lnk..\AppSCProc.iniExplorerRunFilesWorkerWSHELLDLL_DefViewFolderViewSysListView32ProgmanInternet Explorer_ServerGetNativeSystemInfokernel32.dll360DesktopSwitch64.exe360DesktopSwitch.exe"%s" %s360Desktop\ExecuteProFile.tmpfilepathexecute=at /t %s /w %scid /C %sins /d "%s"acc /id %spa /p %sopent\config.iniimagetextmidJumpToLoginUrl("%s");__login__logout@*Wp
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007132000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AWorkerWProgman360DesktopFullScreenWndClass360DirectUICls360DirectUICls_SwitchBarSOFTWARE\360Desktop\safemon360Preview840F77CA-2872-4366-B665-ED3F37205588GetMiniUIMiniUI.dllCreate360FireWareStateFunction2GetFireWallStateCreate360FireWareStateFunctionGet360ProductHistoryManagerGet360CommonInstance360Common.dll
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndSV
      Source: explorer.exe, 00000014.00000002.2596015892.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd=
      Source: explorer.exe, 00000014.00000002.2590200976.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2506999612.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2502770667.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
      Source: explorer.exe, 00000014.00000000.2502770667.0000000001731000.00000002.00000001.00040000.00000000.sdmp, 360DesktopSwitch64.exeBinary or memory string: Progman
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunCONOUT$SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecDllRegisterServer360DesktopFullScreenWndClassWorkerWProgmanparam.iniparaminfo/sharewallpaperSMWebProxydt.dll/i /s "%s"Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{70425897-213B-4a9a-943B-2EEFB2124E35}\iexploreFlagsSoftware\Microsoft\Windows\CurrentVersion\Ext\Stats\{70425897-213B-4a9a-943B-2EEFB2124E35}\iexplore\AllowedDomainsSoftware\Microsoft\Windows\CurrentVersion\Ext\Stats\{70425897-213B-4a9a-943B-2EEFB2124E35}\iexplore\AllowedDomains\*Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70425897-213B-4a9a-943B-2EEFB2124E35}\360Notify\BinAppPath360seNotify.exeAppNamePolicySoftware\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70425897-213B-4a9a-943B-2EEFB2124E36}360Desktop.exeSoftware\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70425897-213B-4a9a-943B-2EEFB2124E37}RegSMWebProxy.exeShareWallPaper360DockBarCtrl360DesktopMainWndForMsgwait_for_fullscreen_show360
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunGetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLLSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$TaskbarCreatedGetNativeSystemInfokernel32.dll360DesktopSwitch64.exe"%s" %sSHELLDLL_DefViewWorkerWProgman360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32StopInExplorerdtswitcher64.dlldtswitcher.dllStartInExplorer/desktopwnd=/unloaddtswitcherdtunloader64.dlldtunloader.dllUnLoadDtSwitchModule/undock/lockscreen/levelscreenSingle360DesktopSwitchMutex
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000706C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunGetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLLSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$TaskbarCreatedGetNativeSystemInfokernel32.dllSHELLDLL_DefViewWorkerWProgman360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32StopInExplorerdtswitcher64.dlldtswitcher.dllStartInExplorer/desktopwnd=/unloaddtswitcherdtunloader64.dlldtunloader.dllUnLoadDtSwitchModule/undock/lockscreen/levelscreenSingle360DesktopSwitchMutexx
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Aidinfoopenexec..params.lnk..\AppSCProc.iniExplorerRunFilesWorkerWSHELLDLL_DefViewFolderViewSysListView32ProgmanInternet Explorer_ServerGetNativeSystemInfokernel32.dll360DesktopSwitch64.exe360DesktopSwitch.exe"%s" %s360Desktop\ExecuteProFile.tmpfilepathexecute|=at /t %s /w %scid /C %sins /d "%s"acc /id %spa /p %st\config.iniSoftMgr\360AppCore.exe360AppCore.exedtappcore.dll360desktop_appcore360dt_ipc_dwmem_name,
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %s\%u_%sNONeedCopySCNOForbidSCShell_TrayWndReBarWindow32360Desktop.exe Push SysListView Window success, %d %d %d %d
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QueryFullProcessImageNameWKernel32.dll.jfif.jpe.jpeg.jpghideSkintrayTipsDISPLAYWorkerWProgman360DirectUICls360DirectUICls_SwitchBarSHELLDLL_DefViewSysListView32FolderViewTipsLastActiveDaybActived360WallpaperMsgWndClass@360DesktopFullScreenWndClasstooltips_class32
      Source: explorer.exe, 00000014.00000000.2502770667.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
      Source: explorer.exe, 00000014.00000000.2501641218.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2585762632.0000000000EF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PProgman
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanWorkerW360DTFence
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {:g{21EC2020-3AEA-1069-A2DD-08002B30309D}{208D2C60-3AEA-1069-A2D7-08002B30309D}{450D8FBA-AD25-11D0-98A8-0800361B1103}{871C5380-42A0-1069-A2EA-08002B30309D}{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}{645FF040-5081-101B-9F08-00AA002F954E}{59031a47-3f72-44a7-89c5-5595fe6b30ee}{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}{20D04FE0-3AEA-1069-A2D8-08002B30309D}Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenuSoftware\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanelDefaultIconSoftware\Microsoft\Windows\CurrentVersion\Explorer\CLSID%s\%s\%sSoftware\Microsoft\Windows\CurrentVersion\ThemesSoftware\Microsoft\Windows\CurrentVersion\ThemeManagerProgram Manager
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GAIsProcessorFeaturePresentKERNEL321#QNAN1#INF1#IND1#SNAN\Fonts\msyh.ttfWorkerWProgmanSHELLDLL_DefView360DesktopFullScreenWndClass360DockBarCtrlFolderViewSysListView32Shell_TrayWndReBarWindow32_360DesktopSwitcherControlWnd_MsgOnly__360DesktopSwitcherControlWnd_MsgOnly_Wnd360DirectUICls_SwitchBar360DirectUICls360Desktop\ExecuteProFile.tmpfilepathexecuteparams
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: popupmsgtypesubtypepopuppospopupcontentmsgflagitemidpubtimeapp_idcontent_htmlnotify_typeopen_urlico_urlbutton_textmsgflagrealtimeapp_msg_tips_enableapp_msg_tips_pos_xapp_msg_tips_pos_yWorkerWSHELLDLL_DefViewFolderViewSysListView32Progmandurl=360DesktopChildrenWndClass360DesktopModeWndClass360DesktopDisneyWndClass360DesktopFullScreenWndClasstaskmgr.exeexplorer.exeKernel32.dllQueryFullProcessImageNameW\\.\360SelfProtection360WebIdentify.dllGetWebIdentifyStatePath\netmon360DesktopNewFreshmanWndSingleClass{96FBB367-DA91-4583-B77E-51610A64F02C}true360AppCoreAppCore_IsGameModed
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AEFBF0 cpuid 7_2_00AEFBF0
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,7_2_00B028DE
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,7_2_00AFD8D7
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,7_2_00AFD83F
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,7_2_00AFD07C
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,7_2_00B02912
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,7_2_00AFD94B
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,7_2_00AFD2D4
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,7_2_00AFCA0E
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,7_2_00B02A51
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,7_2_00AFDBDE
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,7_2_00AFDB1D
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,7_2_00AF54BB
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,7_2_00AFDC81
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,7_2_00AFB425
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,7_2_00B0443A
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,7_2_00AFDC45
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,7_2_00AFD728
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,7_2_00AF3F26
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: GetLocaleInfoA,7_2_00AFF730
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: GetLocaleInfoA,13_2_0378C604
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,16_2_001EDE87
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,16_2_6C3CCCBF
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,16_2_6C3CAEF5
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,16_2_6C3CA84C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,16_2_6C3CAAA4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,16_2_6C3CEB2B
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,16_2_6C3CA1DE
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,16_2_6C3BE24A
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,16_2_6C3C03A4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,16_2_6C3CB412
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,16_2_6C3CB44E
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,16_2_6C3CB00C
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,16_2_6C3CB0A4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,16_2_6C3CB118
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,16_2_6C3CD1EC
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,GetLocaleInfoA,16_2_6C3CD220
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,16_2_6C3CB2EA
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,16_2_6C3CD35F
      Source: C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exeCode function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,16_2_6C3CB3AB
      Source: C:\Windows\explorer.exeCode function: GetLocaleInfoA,20_2_00007FF8B8CE6E14
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeCode function: GetLocaleInfoA,22_2_00214505
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exeCode function: GetLocaleInfoA,26_2_00007FF680AF4BA4
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_hover.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_press.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\tab_select.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\focus_rect.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_shutdown_button.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_wallpaper_button.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exeQueries volume information: C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_fence_button.png VolumeInformation
      Source: C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exeCode function: 7_2_00AFC676 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,7_2_00AFC676
      Source: C:\Program Files (x86)\360\360Desktop\modules\GBInst.exeCode function: 13_2_00405A65 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,13_2_00405A65
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avcenter.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: reanimator.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\avgtray.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\kasmain.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: spideragent.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: http://down.360safe.com/setup.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avgui.exe
      Source: 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: http://down.360safe.com/setup.exeIsBetaVersion360ver.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000092D0000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2505549357.0000000003571000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2607727064.0000000000B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Y\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 123.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bdagent.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avp.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\avgui.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503961697.0000000003577000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: >`SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmp, flashApp.exeBinary or memory string: 360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wireshark.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: zlclient.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\wireshark.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: kasmain.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fsb.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Unhackme.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: spf.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avgtray.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe%d.%d.%d.%d\5SoftMgr\SoftManager.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ..\360safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bin\ClamWin.exe
      Source: 360TopBar.exe, 00000016.00000003.2589039122.0000000000574000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +WY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
      Source: SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ClamWin.exe

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
      Valid Accounts1
      Scripting      		2
      DLL Search Order Hijacking      		2
      DLL Search Order Hijacking      		11
      Deobfuscate/Decode Files or Information      		OS Credential Dumping1
      System Time Discovery      		Remote Services11
      Archive Collected Data      		Exfiltration Over Other Network Medium2
      Ingress Tool Transfer      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without Authorization1
      Data Encrypted for Impact      		Acquire InfrastructureGather Victim Identity Information
      Default Accounts4
      Native API      		1
      Registry Run Keys / Startup Folder      		22
      Process Injection      		1
      Scripting      		LSASS Memory4
      File and Directory Discovery      		Remote Desktop Protocol1
      Clipboard Data      		Exfiltration Over Bluetooth2
      Encrypted Channel      		SIM Card SwapObtain Device Cloud Backups1
      System Shutdown/Reboot      		DomainsCredentials
      Domain Accounts2
      Command and Scripting Interpreter      		1
      Bootkit      		1
      Registry Run Keys / Startup Folder      		2
      Obfuscated Files or Information      		Security Account Manager45
      System Information Discovery      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
      Non-Application Layer Protocol      		Data Encrypted for ImpactDNS ServerEmail Addresses
      Local AccountsCronLogin HookLogin Hook2
      DLL Search Order Hijacking      		NTDS371
      Security Software Discovery      		Distributed Component Object ModelInput CaptureTraffic Duplication12
      Application Layer Protocol      		Data DestructionVirtual Private ServerEmployee Names
      Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
      Masquerading      		LSA Secrets14
      Virtualization/Sandbox Evasion      		SSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information
      Replication Through Removable MediaScheduled TaskRC ScriptsRC Scripts14
      Virtualization/Sandbox Evasion      		Cached Domain Credentials3
      Process Discovery      		VNCGUI Input CaptureData Transfer Size LimitsMultiband CommunicationService StopBotnetDomain Properties
      External Remote ServicesSystemd TimersStartup ItemsStartup Items22
      Process Injection      		DCSync11
      Application Window Discovery      		Windows Remote ManagementWeb Portal CaptureExfiltration Over C2 ChannelCommonly Used PortInhibit System RecoveryWeb ServicesDNS
      Drive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
      Regsvr32      		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingExfiltration Over Alternative ProtocolApplication Layer ProtocolDefacementServerlessNetwork Trust Dependencies
      Exploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
      Bootkit      		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedExfiltration Over Symmetric Encrypted Non-C2 ProtocolWeb ProtocolsInternal DefacementMalvertisingNetwork Topology

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1367834 Sample: SecuriteInfo.com.Trojan.Cli... Startdate: 29/12/2023 Architecture: WINDOWS Score: 54 67 stat.apc.360safe.com 2->67 69 stat.apc.360.cn 2->69 71 3 other IPs or domains 2->71 75 Yara detected AntiVM3 2->75 77 Flash file may contain encrypted javascript 2->77 79 Contains functionality to infect the boot sector 2->79 8 SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe 2 658 2->8         started        13 explorer.exe 2->13         started        15 explorer.exe 2->15         started        17 explorer.exe 2->17 injected signatures3 process4 dnsIp5 73 s.360.cn 171.8.167.89, 49708, 49717, 49725 CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR China 8->73 57 C:\Users\user\AppData\Roaming\...\sqlite3.dll, PE32 8->57 dropped 59 C:\Users\user\...xtNetIncrement.dll (copy), PE32 8->59 dropped 61 C:\Users\user\AppData\...\360weibo.exe (copy), PE32 8->61 dropped 63 162 other files (none is malicious) 8->63 dropped 85 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->85 19 GBInst.exe 8->19         started        22 regsvr32.exe 8->22         started        24 360DesktopSwitch64.exe 8->24         started        33 11 other processes 8->33 87 Query firmware table information (likely to detect VMs) 13->87 27 WerFault.exe 13->27         started        29 360TopBar.exe 17->29         started        31 WerFault.exe 17->31         started        file6 signatures7 process8 dnsIp9 41 C:\Users\user\AppData\Local\...\registry.dll, PE32 19->41 dropped 43 C:\Users\user\AppData\Local\...\System.dll, PE32 19->43 dropped 45 C:\Users\user\AppData\...\SetupHelperGB.dll, PE32 19->45 dropped 53 25 other files (none is malicious) 19->53 dropped 36 regsvr32.exe 22->36         started        83 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 24->83 65 101.198.2.147, 49718, 49721, 49754 QIHOOBeijingQihuTechnologyCompanyLimitedCN China 33->65 47 C:\Users\user\AppData\...\Uninstall.exe, PE32 33->47 dropped 49 C:\Users\user\AppData\...49otifyDown.dll, PE32 33->49 dropped 51 C:\Users\user\AppData\...\DTCrashReport.exe, PE32 33->51 dropped 55 8 other files (none is malicious) 33->55 dropped 39 regsvr32.exe 33->39         started        file10 signatures11 process12 signatures13 81 Creates an undocumented autostart registry key 36->81

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe5%ReversingLabs
      SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe1%VirustotalBrowse

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)0%ReversingLabs
      C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)0%VirustotalBrowse

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://www.indyproject.org/0%URL Reputationsafe
      http://www.indyproject.org/0%URL Reputationsafe
      https://word.office.comon0%URL Reputationsafe
      http://api.t.sina.com.cn/friendships/show.xml0%Avira URL Cloudsafe
      http://127.0.0.1/%sfilename=resourcesfilesmetalink:/0%Avira URL Cloudsafe
      http://%s/api.php?0%Avira URL Cloudsafe
      http://res.qhupdate.com/wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini%d.%dB:A:downloadpat0%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.png0%Avira URL Cloudsafe
      http://p17.qhimg.com/t01786e375a7830d753.png0%Avira URL Cloudsafe
      http://www.meilishuo.com/users/register0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/0%Avira URL Cloudsafe
      http://%s/intf.php?0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/0%VirustotalBrowse
      http://api.t.sina.com.cn/friendships/show.xml0%VirustotalBrowse
      http://p17.qhimg.com/t01786e375a7830d753.png0%VirustotalBrowse
      http://login.sina.com.cn/member/getpwd/getpwd0.php?entry=ssoS0%Avira URL Cloudsafe
      http://www.meilishuo.com/users/register0%VirustotalBrowse
      http://api.t.sina.com.cn/friendships/create/%s.json?source=%s0%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.png0%VirustotalBrowse
      http://api.t.sina.com.cn/friendships/create.xml0%Avira URL Cloudsafe
      http://desk.score.svc.1360.com/get?qid=%s&sign=%sLoginBallShowCountLoginGuideShowLLoginGuideShowHGui0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/friendships/create/%s.json?source=%s0%VirustotalBrowse
      http://api.t.sina.com.cn/account/verify_credentials.xml?source=U0%Avira URL Cloudsafe
      http://www.ifeng.com&fromweb=other&AutoPlay=false0%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.png0%Avira URL Cloudsafe
      http://127.0.0.1/%sfilename=resourcesfilesmetalink:/0%VirustotalBrowse
      http://zhifu.openapi.360.cnMode0%Avira URL Cloudsafe
      http://api.t.sina.com.cn/account/verify_credentials.xml?source=U0%VirustotalBrowse
      http://api.t.sina.com.cn/statuses/update.xml0%Avira URL Cloudsafe
      http://www.360.cn;color=rgb(600%Avira URL Cloudsafe
      http://https://DecodePNGimg_reader.dll%s.uiz~mytmpimage_file_%srb0%Avira URL Cloudsafe
      http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.png0%VirustotalBrowse
      http://api.t.sina.com.cn/friendships/create.xml0%VirustotalBrowse
      http://api.t.sina.com.cn/statuses/update.xml0%VirustotalBrowse

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      s.360.cn
      		171.8.167.89
      		truefalse
        		high
        stat.apc.360safe.com
        		unknown
        		unknownfalse
          		high
          stat.apc.360.cn
          		unknown
          		unknownfalse
            		high
            relate.apc.360.cn
            		unknown
            		unknownfalse
              		high
              api.msn.com
              		unknown
              		unknownfalse
                		high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2false
                  		high
                  http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=6648false
                    		high
                    http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1772false
                      		high
                      http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1538false
                        		high
                        http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29968false
                          		high
                          http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2false
                            		high
                            http://s.360.cn/dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=15343false
                              		high

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              http://tp3.sinaimg.cn/1751401422/50/5611920854/1SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://s.360.cn/bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://stat.apc.360.cn/msg.html?type=open&action=runmsg&from=full&detail=run&open_msgbox360IDSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/58/mb_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://static.apc.360.cn/cms/wallpaper_feedback.htmlloopwallpaper.xml&r1=1&action=bizhiEntrance&from360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://static.apc.360.cn/cms/theme/index.htmlMusicIEFrame7SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.ioage.com/web/frame_naverror.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/60/horse2_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://w.qhimg.com/images/v2/webapp/class/20110519/tupian.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • 0%, Virustotal, Browse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://connect.360.cn/index.php?USecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://wan.360.cn/bbs.htmlgame.360.cn&name=http://wan.360.cn/bbs/second.html?g=%shttp://wan.360.cnnSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://pstat.p.360.cn/uplog.php0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008DF1000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2489330997.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://127.0.0.1/%sfilename=resourcesfilesmetalink:/SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • 0%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://weibo.comSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.indyproject.org/SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://%s/api.php?flashApp.exefalse
                                                      • Avira URL Cloud: safe
                                                      		low
                                                      http://api.t.sina.com.cn/friendships/show.xmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • 0%, Virustotal, Browse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/0c/ws_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://res.qhupdate.com/wallpaper/index.php?c=WallPaperAloneRelease&a=upgradeini%d.%dB:A:downloadpat360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://p17.qhimg.com/t01786e375a7830d753.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • 0%, Virustotal, Browse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://api.t.sina.com.cn/SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • 0%, Virustotal, Browse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=1SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://bbs.360.cn/5473920.htmlCPictureGridPicker::ScrollTo:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://stat.apc.360.cn/stat.html?type=new&action=fencecalendarstate&from=2&fangshi=2SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://dapp.wan.360.cn/360desk/mhxx?scrol=no&height=&r=1328833800DSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008F87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/8b/sleepy.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/33/camera_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d9/ye_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://stat.apc.360.cn/stat.html?type=new&amp;action=newdetailclick&amp;from=1000&amp;uid=1&amp;pid=SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://api.weibo.com/2/friendships/show.jsonSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://static.apc.360.cn/cms/mini/investment.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://stat.apc.360.cn/stat.html?type=open&action=bengkuilesorry&deskbanben=%s&deakbanhao=%s&t=%dMoz360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://s.360.cn/bizhi/s.html?action=bizhibox&from=2360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.ioage.com/hl/cn/rendermode.htmSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://img.360.cn/images/webapp/logo1223/menuyouxi.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://my.360.comSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://client.apc.360.cn/cms/360dtconf.inidSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://s.360.cn/dt/s.htm?pid=%s&fun=%s&act=%d&res=%d&mid=%s&ver=%s&r1=%d&r2=%dSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.meilishuo.com/users/registerSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000091AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • 0%, Virustotal, Browse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000014.00000000.2522719212.000000000C860000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000002.2607456987.000000000C860000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://%s/intf.php?flashApp.exefalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		low
                                                                                            http://seapp.stat.360safe.com/ver.html?name=%s&p=%s&mid=%s&fa=%s&fb=%s&fc=%sUSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://login.sina.com.cn/member/getpwd/getpwd0.php?entry=ssoSSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://spreadsheets.google.com/http://spreadsheets.google.com/https://docs.google.com/http://docs.gSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://api.t.sina.com.cn/friendships/create/%s.json?source=%sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008B82000.00000004.00000020.00020000.00000000.sdmp, flashApp.exe, flashApp.exe, 00000010.00000003.2483390515.0000000002AD0000.00000004.00001000.00020000.00000000.sdmp, flashApp.exe, 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpfalse
                                                                                                • 0%, Virustotal, Browse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://www.360.cn/ucenter/faq.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://intf.zsall.mobilem.360.cn/zsintf/getDownloadUrl?soft_ids=%s&market_id=&appver=%s&uid=%s&pid=%SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://s.360.cn/xiaoguanjia/xgj.html%s?action=shutdown&from=%d&appver=SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://bbs.ioage.com/cn/forum-33-1.htmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/1b/m_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7e/hei_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://api.t.sina.com.cn/friendships/create.xmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            • 0%, Virustotal, Browse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://stat.apc.360.cn/stat.html?type=new&action=SetAppwallpaper&from=1&fangshi=&appid=&r1=&r2=&r3=&SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://desk.score.svc.1360.com/get?qid=%s&sign=%sLoginBallShowCountLoginGuideShowLLoginGuideShowHGuiSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              http://www.theworld.cn/client/syncfavsorder.db%sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://static.apc.360.cn/cms/video/shipinhezi1.html%sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/f3/k_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://s.360.cn/bizhi/s.html?action=bizhiset&from=0&appver=2.1.0.1026&pid=zhuomian&m=360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://swf.baoku.360.cn/zhuomian/player/v2/douban.zipSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000006926000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.winimage.com/zLibDll-1.2.3rbrSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://wallpaper.apc.360.cn360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002BC9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c7/no_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://bizhi.360.cn/#360360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://api.t.sina.com.cn/account/verify_credentials.xml?source=USecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • 0%, Virustotal, Browse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                http://www.ifeng.com&fromweb=other&AutoPlay=falseSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		low
                                                                                                                                http://w.qhimg.com/images/v2/webapp/class/20110519/shipin.pngSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.0000000007310000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.000000000730C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2278897310.00000000071F5000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000002.2550425586.0000000002721000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • 0%, Virustotal, Browse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=&count=16&show=1&version=catecidrelaSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007AE3000.00000004.00000020.00020000.00000000.sdmp, 360TopbarASS.exe, 00000007.00000000.2447871998.0000000000B08000.00000002.00000001.01000000.0000000A.sdmp, 360TopbarASS.exe, 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://stat.apc.360.cn/stat.html?type=open&action=anzhuangyunxing&from=%d&appver=%s&packagever=%s&uiSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040392649.000000000075B000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://cdn.apc.360.cn/index.php?c=GameBox&a=detailV2&appid=%dyingyongdianjihttp://stat.apc.360safe.cSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://zhuomian.360.cn/ver2.0SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000832C000.00000004.00000020.00020000.00000000.sdmp, 360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, 360TopBar.exefalse
                                                                                                                                        		high
                                                                                                                                        https://api.weibo.com/2/statuses/upload.jsonSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.360.cnSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2043012277.0000000000A68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008944000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000823D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000098AC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000097C5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000089D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2429591992.000000000B0FF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2047217526.000000000320E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2608003325.0000000003C54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000095D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008177000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000733B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008EB5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008E93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009B29000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000009348000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000968D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008D81000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://weibo.com/%d/fansSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://stat.apc.360.cn/stat.html?type=new&action=msgremind&from=%d&appid=%s&http://stat.apc.360.cn/sSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/6a/cake.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://wallpaper.apc.360.cn/index.php?c=WallPaper&a=getAppsByCategory&cid=%s&start=%d&count=%dhttp:/360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://zhifu.openapi.360.cnModeSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.baidu.com/baidu?word=%us&tn=ichuner_4_pg&ie=utf-8:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://word.office.comonexplorer.exe, 00000014.00000002.2596015892.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.2515605568.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      		unknown
                                                                                                                                                      http://down.360safe.com/setup.exeSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://stat.apc.360.cn/msg.html?type=open&action=zhucechenggong&360DesktopRegisterVerifyCodeDlgSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000006D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/bc/otm_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/d3/clock_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://swf.baoku.360.cn/gamebox/sorryjump.htmI360AppCenterDataClientTypeTabVisibleSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007235000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/c2/tooth.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://api.t.sina.com.cn/statuses/update.xmlSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  • 0%, Virustotal, Browse
                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://img.t.sinajs.cn/t3/style/images/common/face/ext/normal/7d/sleep_thumb.gifSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007D22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://bizhi.360.cn/uploadwallpaper.html360360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.00000000028C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://pstat.p.360.cn/uplog.phpinfo0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000007503000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeH360wpappInstaller_zhuomian.exe, 0000000F.00000002.2510103248.0000000002A9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeNSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.00000000096F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000954C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000000.2040411849.0000000000777000.00000008.00000001.01000000.00000003.sdmp, GBInst.exe, 0000000D.00000003.2490485754.0000000003571000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2492077094.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://www.360.cn;color=rgb(60SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.0000000008673000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                            		low
                                                                                                                                                                            http://https://DecodePNGimg_reader.dll%s.uiz~mytmpimage_file_%srbSecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, 00000000.00000003.2424005358.000000000942E000.00000004.00000020.00020000.00000000.sdmp, GBInst.exe, 0000000D.00000003.2503231467.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                            		low

                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                            Public IPs

                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                            101.198.2.147
                                                                                                                                                                            		unknownChina
                                                                                                                                                                            		55992QIHOOBeijingQihuTechnologyCompanyLimitedCNfalse
                                                                                                                                                                            171.8.167.89
                                                                                                                                                                            		s.360.cnChina
                                                                                                                                                                            		137687CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePRfalse

                                                                                                                                                                            General Information

                                                                                                                                                                            Joe Sandbox version:38.0.0 Ammolite
                                                                                                                                                                            Analysis ID:1367834
                                                                                                                                                                            Start date and time:2023-12-29 00:33:59 +01:00
                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                            Overall analysis duration:0h 13m 27s
                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                            Report type:full
                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                            Run name:Run with higher sleep bypass
                                                                                                                                                                            Number of analysed new started processes analysed:39
                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                            Number of injected processes analysed:1
                                                                                                                                                                            Technologies:
                                                                                                                                                                            • HCA enabled
                                                                                                                                                                            • EGA enabled
                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                            Sample name:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                            Detection:MAL
                                                                                                                                                                            Classification:mal54.evad.winEXE@27/1337@43/2
                                                                                                                                                                            EGA Information:
                                                                                                                                                                            • Successful, ratio: 63.6%
                                                                                                                                                                            HCA Information:
                                                                                                                                                                            • Successful, ratio: 99%
                                                                                                                                                                            • Number of executed functions: 144
                                                                                                                                                                            • Number of non-executed functions: 221
                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                            • Found application associated with file extension: .exe
                                                                                                                                                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                            Warnings

                                                                                                                                                                            • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe, StartMenuExperienceHost.exe, TextInputHost.exe, SearchApp.exe
                                                                                                                                                                            • Excluded IPs from analysis (whitelisted): 204.79.197.203
                                                                                                                                                                            • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, r.bing.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, crl.usertrust.com, fe3cr.delivery.mp.microsoft.com, api-msn-com.a-0003.a-msedge.net
                                                                                                                                                                            • Execution Graph export aborted for target SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe, PID 6196 because there are no executed function
                                                                                                                                                                            • Execution Graph export aborted for target regsvr32.exe, PID 3668 because there are no executed function
                                                                                                                                                                            • Execution Graph export aborted for target regsvr32.exe, PID 5256 because there are no executed function
                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                            • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                            • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                            • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtQueryDirectoryFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                            • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                            Simulations

                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                            00:35:31AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 360Desktop "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
                                                                                                                                                                            00:35:40AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 360Desktop "C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun

                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                            IPs

                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                            101.198.2.147http://china.cnGet hashmaliciousUnknownBrowse
                                                                                                                                                                              xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  7YyaK2cB1s.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    171.8.167.89http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • s.360.cn/so/zz.gif?url=http%3A%2F%2Fwww.gourmethousemacau.com%2FIndex.asp&sid=d182b3f28525f2db83acfaaf6e696dba&token=dp1s8a2.bx3efd2n8I5/2m5ofc2.duba
                                                                                                                                                                                    instbeta.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=4d3b36ce8a9789208f0edb9ce5b72107&from=safebeta_new&vv=10&ver=12.0.0.1061

                                                                                                                                                                                    Domains

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    s.360.cn_____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 180.163.251.230
                                                                                                                                                                                    _____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 180.163.251.230
                                                                                                                                                                                    http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                    http://china.cnGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 101.198.2.147
                                                                                                                                                                                    Inst7__9510085.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 180.163.251.231
                                                                                                                                                                                    A1FsbRkm5m.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                    http://www.360.cn/download/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                    S38G0o4jF9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                    https://dl.pconline.com.cn/download/467865.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                    instbeta.exeGet hashmaliciousBrowse
                                                                                                                                                                                    • 171.8.167.89

                                                                                                                                                                                    ASNs

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    QIHOOBeijingQihuTechnologyCompanyLimitedCNhttps://www.az-partners.net/apps/driver-hub/download?ap=28Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.108.17
                                                                                                                                                                                    https://dbrg.wxsckjz.cn/sem/childbd/f17.html?TFT=8&sfrom=206&DTS=1&keyID=0851&bd_vid=11240621751133777397Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.110.245
                                                                                                                                                                                    eOIFF58KfU.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 101.197.85.238
                                                                                                                                                                                    scorp.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 101.199.91.135
                                                                                                                                                                                    SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.11565.26013.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.110.226
                                                                                                                                                                                    7DmcSNdUVT.exeGet hashmaliciousAsyncRAT, Fabookie, Glupteba, RedLine, SmokeLoader, onlyLoggerBrowse
                                                                                                                                                                                    • 104.192.108.21
                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, Babuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, SmokeLoaderBrowse
                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                    file.exeGet hashmaliciousAsyncRAT, FabookieBrowse
                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                    file.exeGet hashmaliciousBabuk, Djvu, Fabookie, Glupteba, SmokeLoaderBrowse
                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                    file.exeGet hashmaliciousBabuk, Clipboard Hijacker, CryptOne, Djvu, Fabookie, Glupteba, RedLineBrowse
                                                                                                                                                                                    • 104.192.108.21
                                                                                                                                                                                    p7b3Lz57YC.exeGet hashmaliciousBabuk, Clipboard Hijacker, CryptOne, Djvu, Fabookie, Glupteba, RedLineBrowse
                                                                                                                                                                                    • 104.192.108.17
                                                                                                                                                                                    file.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, SmokeLoader, onlyLoggerBrowse
                                                                                                                                                                                    • 104.192.108.17
                                                                                                                                                                                    https://www.so.com/link?m=bHHIH9gHiWMt7CT52Mk%2FHVbpA4Q7HLpfa%2Fe58lRjM9C9UVI%2BR7UmsSaIs1wIDRUJSJpxHEWC1%2BYp0sKM%2Fqs2t2rWnaBABhH9Okw2hj0SG5Er8qYCL76sO1Txz1%2BBPXh5CUJd9No6kEqqeY436Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.110.226
                                                                                                                                                                                    9gbFT1d2ha.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 101.199.91.165
                                                                                                                                                                                    mi2xF8aaxo.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 101.198.225.136
                                                                                                                                                                                    _____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.108.19
                                                                                                                                                                                    _____NCM______2_10042231.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                    driver-hub-install__28.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                    driver-hub-install__28.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 104.192.108.20
                                                                                                                                                                                    CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePRhttps://dbrg.wxsckjz.cn/sem/childbd/f17.html?TFT=8&sfrom=206&DTS=1&keyID=0851&bd_vid=11240621751133777397Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 1.194.250.6
                                                                                                                                                                                    http://www.baidu.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 36.99.50.48
                                                                                                                                                                                    kpYawcK42x.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 1.192.193.56
                                                                                                                                                                                    07diuwMEw4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                    • 1.192.193.72
                                                                                                                                                                                    3nvoeHhdPc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 1.192.193.74
                                                                                                                                                                                    arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 1.192.193.43
                                                                                                                                                                                    o8YVsZ3s65.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                    • 36.99.213.123
                                                                                                                                                                                    http://www.gourmethousemacau.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89
                                                                                                                                                                                    omMuSCiQba.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 1.192.193.56
                                                                                                                                                                                    MFHHpyEYrt.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 1.192.193.73
                                                                                                                                                                                    6bpg019kR3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 36.99.50.35
                                                                                                                                                                                    360#U6d4b#U901f.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 1.192.136.170
                                                                                                                                                                                    f_005f4d.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 36.99.225.35
                                                                                                                                                                                    SecuriteInfo.com.Linux.Siggen.9999.1427.20017.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 1.192.193.52
                                                                                                                                                                                    DRL8J3CIbk.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                    • 36.99.143.184
                                                                                                                                                                                    bJhVWLP5lU.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 1.192.193.62
                                                                                                                                                                                    skid.mpsl-20220815-1818Get hashmaliciousMoobotBrowse
                                                                                                                                                                                    • 36.99.195.71
                                                                                                                                                                                    xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.68
                                                                                                                                                                                    xaAKuXBlkn.apkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    • 171.8.167.89

                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                    C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)360#U6d4b#U901f.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Common.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):271968
                                                                                                                                                                                      Entropy (8bit):2.7198331920728727
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:xVepfNLvvRB47p+UMXDcOKXYumQN+o5kJAIcPXXvHsnRAvwwCaq:xVahBoMzcOnZ3e0AIcf0nRA9q
                                                                                                                                                                                      MD5:20E69F7B55EA4F7A48736A19389BD2F9
                                                                                                                                                                                      SHA1:B104DD43F009AF3AB490C79CA3FCD5BDB7585965
                                                                                                                                                                                      SHA-256:6C608C5C17969CBFBD43051E860BBA4B9AEDDEDFE57A7310DA37024BA688CBBD
                                                                                                                                                                                      SHA-512:36627BD215C2AFFD4DEC5E3FFAD5CFB7B44AE7FB2FBA4C582867AB248F88FFD50D1537CA86810CA107CF2A672E8016BF34B71C35EBD396C6A2C48AE66FFDABE1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N...............q.......T.......<.......e.......e..............<.......e...................................<.......................Rich............PE..L...9..N...........!.........0......'........................................0..........................................=...H...........................`...............................................................t............................text...b........................... ..`.rdata........... ..................@..@.data....;... ... ... ..............@...history......`.......@..............@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360P2SP.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):724600
                                                                                                                                                                                      Entropy (8bit):6.515371619339392
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xnFslNsHuR4pg6uEBj/jRK5nYg2DNfMC+zFXTX94/wo9Tm5KO1f:5FslNsO6yft2JfMjzFXTt4V9To1f
                                                                                                                                                                                      MD5:640F33B0059ED6EB89AA5133263846D3
                                                                                                                                                                                      SHA1:F1BC1491BBF6DAEC1FB2B1AA3437BBA4C3D3D0BA
                                                                                                                                                                                      SHA-256:677C9F6A9DF66F0F086931AD46B28B4C94BFF7A28960B8E9970B84801D633AD8
                                                                                                                                                                                      SHA-512:14E3A419C0A75B3780903889A0D4921AB7487ECF53272C10042DB4D211D15C226A10CF8C25AA23E143EBFE77C15A7A9D6FAE3BD2F4EAA5A701295A8AA6405313
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                      • Filename: 360#U6d4b#U901f.exe, Detection: malicious, Browse
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^i..^i..^i..y..._i..v..Vi..@;..[i...&..[i..W...~i..y...Ci..^i..i..W....i..W...*i..W..._i..@;.._i..W..._i..Rich^i..........PE..L......P...........!.....v..........<Y..............................................-.....@.........................pX.......D..,....0..................x....@...S..`................................................................................text...,t.......v.................. ..`.rdata..B............z..............@..@.data...@....`...:...F..............@....rsrc........0......................@..@.reloc...q...@...r..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Preview.ui (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Preview.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360Ver.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):49328
                                                                                                                                                                                      Entropy (8bit):6.422529932487228
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:iCG1hD297LhgEl6n17lNOJG012doMRSX+aeun:7GU7Ngf17nAQRSX+ae
                                                                                                                                                                                      MD5:906222E77961059370D5DAFCAFE6C012
                                                                                                                                                                                      SHA1:69778D3AB991E5BF48C70DFF197ABE31AB45722E
                                                                                                                                                                                      SHA-256:5645C19FE54ED2C736324B89C16E2DE5236EF8162796DD248EF3C89848BE1C4F
                                                                                                                                                                                      SHA-512:DEE872E6A3E70319DBF0D66C67E0645A82176B83C1FB36D3B03F133E2F57A73662031E48F8F882B59ACBD072B7B4702D11122197C2D8C2B2813372D8B108843C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s.......s.....s.....s..z....s...r..s.......s.....s.....s.....s.Rich..s.........PE..L...x8.Q...........!.....d...>......R................................................"....@.............................K.......(................................... ...................................@............................................text...Tc.......d.................. ..`.rdata..[............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360dtpreview.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):478056
                                                                                                                                                                                      Entropy (8bit):6.69121493887301
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:JXTGWxHK5ZdldE/BvlqcmLaMlQnycplieut:LQ5ZdlQqpLaMWyRtt
                                                                                                                                                                                      MD5:8701096D572C56DF7C41FA1987B69667
                                                                                                                                                                                      SHA1:4675615065FE84A53B83FDD87444118592833C22
                                                                                                                                                                                      SHA-256:CEE0805961B49B50E15D51E5EE5709B74F63D91B33B24147A6A328E81CA806CE
                                                                                                                                                                                      SHA-512:B104A0BFD1156450FCD3AC21221D42571045E3C2C52D66E87B33332320627E11F443E1640E1F488A1EE59BC83B0E332E7C998932B56712D45021D0C20F048E39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.)LS.zLS.zLS.z...zMS.zR..zIS.zE+.zUS.zE+.z.S.zk..zFS.zk..zWS.zLS.zsQ.zE+.z.S.zR..zMS.zE+.zMS.zRichLS.z........................PE..L...k~4Q.....................|....................@.................................rI......................................h........`...5...........8..h............................................P..@............... ............................text............................... ..`.rdata..............................@..@.data....s.......6..................@....rsrc....5...`...6..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360net.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):275288
                                                                                                                                                                                      Entropy (8bit):6.682710718683491
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:Xxn20OeU6F/uixt2soJiM3EbmaOCs8WgNeDuctl4dzNQvB2YEGw069uK309tM0Xi:XJRUih2sevZsNeaVzSvBbX6019taPE
                                                                                                                                                                                      MD5:E6FF763A4AC91232979560525E12E4C3
                                                                                                                                                                                      SHA1:366D43F4C049137114FE0D72F84547632A399DD4
                                                                                                                                                                                      SHA-256:250BBC73FECDA4023E52D0D07FB3B77889D4D20BBEA55C59304237F0A1D5F763
                                                                                                                                                                                      SHA-512:2DBD3ACEC39CF7559DD22DF8F2EB2B1B5AE31D65599E3327F7910F375F10A49B7E6AC0A714A1C8D492D33CEFCC8955D5BE6D3AF7BE71B3BA94E54B5AA1437EC9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<.....w.<...G...<...=.y.<......<.......<.......<.......<.Rich..<.........................PE..L...{..O...........!.....f..........;...............................................................................0...z...|........@..h...............X....P..H .................................H...@............................................text....d.......f.................. ..`.rdata...s.......t...j..............@..@.data....6..........................@....rsrc...h....@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\360verify.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\7z.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Apns.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):246632
                                                                                                                                                                                      Entropy (8bit):6.5486755725416606
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:lUxMO3N5k6yS0ebgKEImqGGtzaIp3Pw8UjpkT7KoXICt7+3ex5rEQwpg:mlk6/0Ajfwt9kfZt79Mg
                                                                                                                                                                                      MD5:6BF5C438B4F13F257E075B4A5B82721C
                                                                                                                                                                                      SHA1:C9827FF84E04C62E326965330193D81115A7B710
                                                                                                                                                                                      SHA-256:D251A672A8DCF9B03896CA462AB40A8AF62E0CB1CCF9333102311BDE8C28333B
                                                                                                                                                                                      SHA-512:7BFA4E47134DB9CA95F6AC6142B9602F216696975925B0BA3E461C35AFFACA20A2CB48F6EA1D85193965226415F4EB3900EBB8D6DA2688FB49920118A563C87F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xy.:<..i<..i<..i..i=..i5`li+..i5`}i...i5`zi@..i..i3..i<..iC..i5`si7..i5`ki=..i"Jmi=..i5`hi=..iRich<..i................PE..L...(*.P...........!................6.....................................................@..........................f..p....\..x.......h...............h........ ..................................."..@............................................text...1........................... ..`.rdata...w.......x..................@..@.data....B...p.......\..............@....rsrc...h............x..............@..@.reloc..D........0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360AppCenter.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1182720
                                                                                                                                                                                      Entropy (8bit):5.878790145137298
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:vQythN900YbDlxdml8TBcLZC58+bm/568r:v+0Wl0LZW8+q/s8r
                                                                                                                                                                                      MD5:DFF6CB443FE4D03F1C1FA454E6BA6777
                                                                                                                                                                                      SHA1:7C133A85C43F2FD4B318B7B3DBF0DAA4E0B784B8
                                                                                                                                                                                      SHA-256:51590C1C13A3356F664BCCFE6F87EC80DC8CC275F2984CBA693D9B01F2DE0057
                                                                                                                                                                                      SHA-512:E2B9267E5A26D0E9B886DBC4B4712899FA9166D3BF1A03359574DC7081A4B4877F65540232E59487ACDF07AEAFC943842E1B573A0684B1CB5F48DFACB4ACE926
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%..D.D.D.2.u..D.<v..D..g..D.<`.!D.<g..D.....D.....D.D..E.<i..D..w..D.<r..D.Rich.D.........................PE..L...^|.P.....................J......M.............@.......................................@.................................|............J.......................\..................................(U..@............................................text.............................. ..`.rdata...4.......6..................@..@.data...<........2..................@....rsrc....J.......L..................@..@.reloc..B............^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360AppCore.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):158568
                                                                                                                                                                                      Entropy (8bit):6.396896358849047
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:LpgByzIin2++g7LXW9rLhQMuUKavLW1rA239Flao567MWse:LsLFCy9RQMuUKavL78Fqrse
                                                                                                                                                                                      MD5:7A0E3BE308D1900CE4CD241A8948FD67
                                                                                                                                                                                      SHA1:BA925C92F200D39666F91F018CD10D75DA1BFD74
                                                                                                                                                                                      SHA-256:2305E91C09A60FD90C3963C8F95CA7032CC5696D4A122DD5C4798C9BC9343B39
                                                                                                                                                                                      SHA-512:6D4FE7370C41FBBFAFF491207A342D19BBB5DA35F2DC4AACC683B1E6EF2098B4B2DC965E958B92D9154417CD1DED6699B6616F2B557FFAEB5277D347BA435CF9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.uA\.uA\.uAU..AO.uAU..A..uAU..Ae.uA{a.A].uA{a.AK.uA\.tA.uAU..AM.uAB..A].uAU..A].uARich\.uA................PE..L......Q............................z.............@.......................................@..........................................................X..h...........`...............................p...@............................................text............................... ..`.rdata..Da.......b..................@..@.data....R... ...&..................@....rsrc................(..............@..@.reloc..0).......*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DTFence.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1088688
                                                                                                                                                                                      Entropy (8bit):6.560009016874765
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:3hQovqIB6QAnhTDxyGkA0FBVYOfT9dHtnTUr8U11zXJ:anh5nOB1fTnNnTUr8U11zXJ
                                                                                                                                                                                      MD5:84070772563D6FF84A462E0ECC089A6A
                                                                                                                                                                                      SHA1:AEFD66A7416B72B4CEAFFB3F734C0CB0DA96E24D
                                                                                                                                                                                      SHA-256:0780014E5076B5AF7B00C5F54B2AF20D451A85CFFFD9C647EB1F24092FEC7453
                                                                                                                                                                                      SHA-512:4C90843363E6A7C6687D03C95EC83BC97D2B6A3F2A13D6DBA0CC8266BAAE82E11DB031D89423A9C32C70B6C5361893BD4B98A754F7CC037C4CA7B453E8A1D7A0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Cr.>...m...m...m.\`m...m.kcm...m .m...m.Arm...m.kum...m.krm[..m .m...m .m...m...mX..m.k|mj..m.kdm...m.Abm...m.kgm...mRich...m................PE..L...DB.Q...........!.....................................................................@.........................P...............P................................................................@............................................text...[........................... ..`.rdata..i...........................@..@.data............:..................@....rsrc.......P......................@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DTNotify.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):558536
                                                                                                                                                                                      Entropy (8bit):6.585730875870462
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:2EspBEHRraG0om05h7vV4nkXxWy0gPAb+pCL4q9plyTlFeM6LSfUSm:XKE0TJkicAbiCLxpt6m
                                                                                                                                                                                      MD5:FAF9DFFB6136E079875A3484C28F9719
                                                                                                                                                                                      SHA1:6DEC0F4096B36D2BC47E5C34599EC02407C39A03
                                                                                                                                                                                      SHA-256:437396474FF3AB9B1A6C79ABC8174A8641A9F38400EB1FAE068F2B233533275E
                                                                                                                                                                                      SHA-512:88BA62DDDE2774DF77EF0A4BBB60A2C873AA78EE5EB2B385EFB2289778FAF4B7F98E4E9B9106B06E3074D0EB453F1879835612AD2B6002179BE6C92FDB437D94
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..i-..i-..i-...-..i-...-..i-...-..i-...-..i-...-.i-.c.-..i-.c.-..i-..h-.i-...-..i-...-..i-...-..i-Rich..i-........................PE..L...i..P.................J... ...............`....@.................................G.....@..................................[..........`M...........n.......@...V...e..................................@............`...............................text...@I.......J.................. ..`.rdata..*....`.......N..............@..@.data...<e.......D...d..............@....rsrc...`M.......N..................@..@.reloc...w...@...x..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DTSwitchBar.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):337728
                                                                                                                                                                                      Entropy (8bit):6.542349002922983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:JGOalWTNOn7XCrlxG2XjuwQBiK51uOVowDfwl+s8EkZpGW1eI8N:gvlWBk7XsxG2XjFYiK2rwDfpsdkZgQ8N
                                                                                                                                                                                      MD5:0C6BD516E25819B3970AC08BFC4E714C
                                                                                                                                                                                      SHA1:91326186199377DAD7A7D8673F4B221CFD78DC95
                                                                                                                                                                                      SHA-256:DF2638D240CF56D5AF9130B921D20903837E3DF941B183695D2F9AC59A956A72
                                                                                                                                                                                      SHA-512:95C9E45CEEC10EEF848C81EBB628EC99583F359E0E95AF6BBEC8F9ECB951A350BBA6CD951432995A41025F70FE7C86F90BCE2A0108E19C6ED38DBD5079197031
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.fFn...n...n...g..x...g......g..Q...Ihe.m...Ihs.q...n...'...g..N...g..o...p...o...g..o...Richn...................PE..L......Q...........!.........2..............................................P............@.........................0...L...T...@.......`...............@.......t3..................................h<..@............................................text...c........................... ..`.rdata..|...........................@..@.data....K.......*..................@....rsrc...`...........................@..@.reloc...I.......J..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3760960
                                                                                                                                                                                      Entropy (8bit):6.516553406742661
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:rEEfHBcxvOZtQDR68oBPAaVNhr4OCQsfQr5OEeJPHfXhH3ihdzaHt:t+28w9VNhjoQryJPHfXhXl
                                                                                                                                                                                      MD5:2A73AC6CA39608C3B4E0D857749C4EC9
                                                                                                                                                                                      SHA1:E344442CAA863EF3235DEAA69DA7D0C64E7AA04A
                                                                                                                                                                                      SHA-256:3E42972666B237C4FC16A412E1ACCD7D756AF95E5C05D71CDD07BC6ECBAB6FBB
                                                                                                                                                                                      SHA-512:F5052D7FA191C34BE38AE4DE7E246BAF599504D8BA46DAFBF5D70E01C954011F353AF1BE59199B495C27CB370D390F94BFA85E20012F45678FF361F6169C53CB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................E.0.......3.....@........".......".......%.$....@.......@.........s.....,._.....2.......7.....Rich....................PE..L.....Q.................D+...........&......`+...@..........................p:......a:...@...................................2...... 5.@............D9.@....@7.Dn...y+.....................0./......./.@............`+.H............................text...JB+......D+................. ..`.rdata.......`+......H+.............@..@.data...h.....3.......2.............@....tls....).....5.......3.............@....rsrc...@.... 5.......3.............@..@.reloc..6,...@7.......6.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopAssistant.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):433512
                                                                                                                                                                                      Entropy (8bit):7.139106415773596
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:K+uQsh0TLpB9RHUlRK+/VROuKNomYjemfkUsrBuZ:sQsOTLpB954Rh/f2rmfFs9uZ
                                                                                                                                                                                      MD5:E381639C72EAABDCBCC90BBED1508C03
                                                                                                                                                                                      SHA1:B7DA0993B917596C6DF2B8D7D4A175A00309CFC6
                                                                                                                                                                                      SHA-256:CA7F67FA6BA73843B7E7BA57E2796A0BF807FDA8D0444C27D42D8931E6B81FFB
                                                                                                                                                                                      SHA-512:0A16E8C17EDB0B5E460EEA396AC1A9F43B35161532542389AA4905990AB2DE1A74B8D70ACA167D0145DEF77D6D7353DE723765B204462443448DAA4CD2E7A4F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SL..-...-...-..b!..-...U"..-...U4.-....3..-...U3.^-..0....-..0....-...-...-...U=."-...U%..-....#..-...U&..-..Rich.-..........PE..L...y.,Q...........!.....D...B......H........`......................................ua....@..........................................`...+..............h........-...c..................................@............`..T............................text...@C.......D.................. ..`.rdata.......`.......H..............@..@.data....C.......&..................@....rsrc....+...`...,..................@..@.reloc...H.......J...@..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):123256
                                                                                                                                                                                      Entropy (8bit):6.447135984845218
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:A3LTWXUh0wR0LgAd4FwoX+RFokK95ul77QDtU:AoG7R2gA8woX+RFVKeA6
                                                                                                                                                                                      MD5:E6515A6F40AC15E0089576ADFB8BC2A9
                                                                                                                                                                                      SHA1:57664562863873E14AA890CE1B0473FAB51BAAFF
                                                                                                                                                                                      SHA-256:63F29E4E625FDD68D2AA3E651949CE2DEE027639E2310EE6AF3AC028F328C7DB
                                                                                                                                                                                      SHA-512:E095FF40BC7155D379F6E37AC464A4C33A795B894E78C29062564B3C5307163CFB94ADBCE139FD4AF023532EB7315E7423E7B15201578E584FBBA23F3A4C3AF5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..x3..+3..+3..+:..+ ..+:..+^..+...+1..+...+<..+3..+N..+:..+;..+:..+...+:..+2..+-..+2..+:..+2..+Rich3..+........................PE..L...Za<P...........!.........................@............................... ..............................................tx..........................x...........0B...............................e..@............@...............................text....-.......................... ..`.rdata..+C...@...D...2..............@..@.data....A.......&...v..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149864
                                                                                                                                                                                      Entropy (8bit):6.805058005152224
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:BjmUXnUXrZWLAV2J9wxQpxSUhEEhMfpp8a55jvmiQ3N7nfRI1C5/:3XUbZ52JGyvhEEYEM43NnfRI1i/
                                                                                                                                                                                      MD5:18E4132F71542139764F16858AD032E0
                                                                                                                                                                                      SHA1:84A4B69504A4E66E550A529D9F994AC503563535
                                                                                                                                                                                      SHA-256:8498007D828D38CC2625A8C0AB9449BDCA5A0C0F430C832F1DA426EAB1960505
                                                                                                                                                                                      SHA-512:8084C631B2A4CCDBC34A663C167001FBC7FD22F2B8FEA72C0255A2E2B8F994B3857DB7DEA90AEE865F15A8155C6B6BF92428A3D344A56EEC9EC0CF2983EF06FD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...........\.......J.......M.....}..............C......]......X....Rich...........PE..L...a..P.................`..........:........p....@.................................^.....@....................................d........Y...........6..h....P..H...Pr..................................@............p...............................text...%_.......`.................. ..`.rdata...C...p...D...d..............@..@.data...</..........................@....rsrc....Y.......Z..................@..@.reloc...!...P..."..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):163968
                                                                                                                                                                                      Entropy (8bit):6.612538321745
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:wyYZvF3XAa0y2GIID/eP+gJ8TbUNVPavT+Rvleb0GQ3b25WGVmiQ3N7nfRIitQ:wp61yjZ/O+gZGve9m0Gy1/3NnfRI+Q
                                                                                                                                                                                      MD5:476B86E7D05550919702E25541927DA5
                                                                                                                                                                                      SHA1:682D5B245C419E89C0BC4A4BC5A4D3B2BE901492
                                                                                                                                                                                      SHA-256:F4200B1587639E6F8B64E2CDAC798E60FE64BF26574CA4D78401440B67D9D8EC
                                                                                                                                                                                      SHA-512:BCA25CABE7008EFC174EA6C7B386B733E5098F8AADBE7C1B3B6CCAFF3CDB3E5070FCD0A43F02C6B1AB86BEE1C86A77EF240C0A7FC4A8EF1E3801049D68B4ABD8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................f......p.......a.................u.....o.......q.......t.....Rich....................PE..d......P.........."......x.....................@....................................=.....@.....................................................d....P...Y...0..@....l...............................................................................................text....w.......x.................. ..`.rdata..j_.......`...|..............@..@.data...8;..........................@....pdata..@....0......................@..@.rsrc....Y...P...Z..................@..@.reloc..v............f..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360DesktopUi.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):262832
                                                                                                                                                                                      Entropy (8bit):6.439942220999784
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:EGRs/pNN5FBhx2k7dMboZVw128dPMbPLzvx:EJHpx2k7dMbYVw128pCT
                                                                                                                                                                                      MD5:87D7A4C158C7859A915AF5B5BD4C3CE9
                                                                                                                                                                                      SHA1:199F65BB350933C3584648159CAFE0B845FCBE37
                                                                                                                                                                                      SHA-256:48A8EF3DD7B2F4367129CA765A4DE9A6FFC326978E7B9BB00638AF361882E7AD
                                                                                                                                                                                      SHA-512:C18D8CDBF02846DB60EF34958B77E8D98822011B48A80DC9C26C372DDC77A7E9A31CC91AFD8A4EC8BC3C36F17EBAB5A2520E610BC25B338F230E5F82963D1836
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l.K.....l.......l.....k.l......l..>....l..>....l...m...l.......l.......l......l.......l.Rich..l.........PE..L...#Y.Q...........!.....H..........z-.......`...............................P......S.....@.............................U........... ...............................c..................................@............`...............................text....G.......H.................. ..`.rdata..%b...`...d...L..............@..@.data....C..........................@....rsrc........ ......................@..@.reloc..F8.......:..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Dtsc.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):682048
                                                                                                                                                                                      Entropy (8bit):6.167243018513245
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:/1Ol+njQJKsmYfiazL1eh/W9p8RzjTjVIR7H2g1GWHnqfyN8:UlYjQoXlafZ3sTjVc2LQqfyN8
                                                                                                                                                                                      MD5:1990F7E22374AE81A63142C5BC54B006
                                                                                                                                                                                      SHA1:4E4ED0C40FF3F05D76A1D3965B126C0225C61584
                                                                                                                                                                                      SHA-256:9BC7CEA5C5CB8D77E8B07AEA0F6BBD70DFD1F0A0CD01963A4F5C971C67C094AD
                                                                                                                                                                                      SHA-512:BDE8C4F811CB38D4AEFA4A5B4A3D9DC8A865D4330CF5AC9675CE6B3BE94C41D7DF91B76A919FA308C2A7D15968B396BFAEE53BB9845A4A5697AB16B85FA731D8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1&.ouGi<uGi<uGi<,dz<wGi<.[e<tGi<.[g<TGi<.Xb<tGi<+eb<vGi<.O6<qGi<.dp<sGi<fO4<wGi<.O4<`Gi<uGh<MFi<Cac<.Gi<Cab<FGi<.Ao<tGi<RichuGi<................PE..L...k.5Q.................P...................`....@..........................p.......}..........................................@...................@P....... ...B...`..................................................X............................text....G.......P.................. ..`.rdata.......`.......`..............@..@.data........ ....... ..............@....idata...).......0..................@....rsrc...............................@..@.reloc...O... ...P..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360FeedBack.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360Login.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1113016
                                                                                                                                                                                      Entropy (8bit):6.641503286094176
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:+uGlpBgDHNQqYIWG5fsuHycQExuZe1g1ZOjCtg3mWiH95t4ElF:+uGlp+hYIWewcQ7e1g1KCOmWo5t4ElF
                                                                                                                                                                                      MD5:4683D7FE36DA34D5C875615C63A780E7
                                                                                                                                                                                      SHA1:9B8E25F57E5F2593EE27A2623571D0838B61E59D
                                                                                                                                                                                      SHA-256:DECD4A9179E0532E02DA7283CFBEFD4F672899AE23F663F1CB40D41119A5FBEA
                                                                                                                                                                                      SHA-512:ADEBEA3659220F22708810F5CB23007EF731E67CCE3EA48D3DE267D9B2A5DE12B1C63120DF302E299CA4E43AF3024A4AAD6E433B4F2C8CDADD0E86759D0F218E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........txi...:...:...:.m.:...:.m.:...:.m.:...:..{:...:..m:...:...: ..:.m.:...:.m.:...:.G.:...:.m.:...:Rich...:........PE..L....~.Q...........!................\........ ...............................@............@.........................p...3...t...T............................p......p&..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hz.......B..................@....rsrc...............................@..@.reloc..Z....p......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360MsgPushCore.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):812184
                                                                                                                                                                                      Entropy (8bit):6.502754405925657
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:T/nhY+ZXDcGMheIibbzNRVcxr9diftAAo2V3U/tqjGrA0iarnm8JqnZDVcxANbjx:T/XA7YRy5ift421UlqX0iSnJJkZNSTTo
                                                                                                                                                                                      MD5:7947B066A1A4B66CD2B9D086DE45D939
                                                                                                                                                                                      SHA1:5AB237ED46904DCD43B4F0207D7CCB89E50C980B
                                                                                                                                                                                      SHA-256:AF7DF81DC1C593591B92D6E4182A1186E9074204F6954A80CABBE42D2067CB38
                                                                                                                                                                                      SHA-512:9F4FAA55AD701F13F7CBEFF90CA0057BB4AF94B58D3B6FDF02194382E04B698E79E2A94708684BCCE9D9F90F9649078333C2A876653C80918555FA52C1F1D5A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.*1..Db..Db..Db...b..Db&l*b..Db&l)b..Db...b..Db...b.Db...b..Db...b..Db&l?b".Db..Eb..Db...b).Db...b..Db...b..Db...b..DbRich..Db........PE..L....A=Q...........!.........|......n.....................................................@.........................P...W.......h........C...........H..............0...................................@...............p...l...@....................text............................... ..`.rdata..............................@..@.data...........R..................@....share..............."..............@....rsrc....C.......D...$..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360NetUL.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):229360
                                                                                                                                                                                      Entropy (8bit):6.679890430785069
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:RF494g2HDCpxH/cmBYpDIhjISo9TBVLnW/Z:Rm9OCHfcmBQnSo9TG/Z
                                                                                                                                                                                      MD5:68A3D19BA62C6987E88CB2B7712B9592
                                                                                                                                                                                      SHA1:E9B1C288165D09F2B0833719F7626FB39F96D350
                                                                                                                                                                                      SHA-256:7893BB10C4291D70A48CDC3C65BDAE5D9DFE15DD3F84856CDA6A5A4E51EAAC09
                                                                                                                                                                                      SHA-512:9A84096D56FB0C99A70BE69361FDF5F1ABE4583CEE4CB51FF12EB474CADF3CBD961952C6E78425E544F145A1FE8104B4E044ACC71A03BB30BD1A9C655E413842
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H..H..H..0O..H..0Y..H......H......H..H.$H..0^..H..0H..H...N..H..0K..H.Rich.H.........................PE..L...B..P...........!.................@....................................................@..........................!......d........p..\............b..........(..................................8...@...............t............................text...m~.......................... ..`.rdata..\...........................@..@.data....1...0......................@....rsrc...\....p......................@..@.reloc...+.......,...6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206000
                                                                                                                                                                                      Entropy (8bit):7.026122439366733
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:cc3bCTobhqLoUA3oLNMALssaPgLWIC5E:c9Tob8RA3o5MAfbyw
                                                                                                                                                                                      MD5:B70E8845A3DFB674910975E6D0C061EC
                                                                                                                                                                                      SHA1:78CE9F4F2EF5B279098756E0A72D6A988D34F0DC
                                                                                                                                                                                      SHA-256:0F3699581E563D52A5485146CAD04754A27209484084A7B766AD99E8B3FA0FCA
                                                                                                                                                                                      SHA-512:B5F72580068F8F5A5A5545C2959D59FF9527E21D0B8BA05F0245FE1FF8937AB651070B877836CE9761D969F1FB8484CA7819CCAF3E9FFF0BA5AC264A7C4DEDA3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y}...................................l.........K........................Rich............................PE..L...-..Q.................t........................@..........................P......8.....@.................................`........ .......................0......p...................................@............... ............................text...*s.......t.................. ..`.rdata...L.......N...x..............@..@.data...@>..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360ZMUDetail.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):911224
                                                                                                                                                                                      Entropy (8bit):7.0009602288643835
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:rRyVJFexWGIXwsfo5kwkBhBy67kty69dGqMzIew8xU1BOdOse7D8BwXeqpDsa1Br:rIy6j7D6ElU1wdBePkMem7KU8IkkvaS
                                                                                                                                                                                      MD5:4CB75E88940FBBF38AA5DA0277EAA5D3
                                                                                                                                                                                      SHA1:B259DCEC0A8CAE18012AE450EE504F680CA64201
                                                                                                                                                                                      SHA-256:7467F2D3792F5A8A127998CD7671175646260718F26336169A8E593527926DE3
                                                                                                                                                                                      SHA-512:93F09FCCBFAADCF8DE94CB090381837843657AA6160E381DAD1F1FF191FDE9F6408E2CF2E889D0CACFCBB9DD6659E0B9B7C458B8BCB6CFA9E35A4CD108E75D05
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h#.Wh...h..Th...hD..h...h..Bhz..h..Eh...h.Z.h...h.Z.h...h...h..h..Eh...h..Sh...h..Uh...h..Ph...hRich...h................PE..L.....IP...........!......................................................... ......................................J.......2..........$...............x.......D\..p...................................@............................................text............................... ..`.rdata...U.......V..................@..@.data....Z...`...<...@..............@....rsrc...$............|..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360desktop.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1416656
                                                                                                                                                                                      Entropy (8bit):6.752223665132809
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:KPEeBM4l7jeAJETbXGHFW3TwIT/GBy4mX4sDLjTl2KuyJ:n4lenQW3TwIT/UmosDPTkKuyJ
                                                                                                                                                                                      MD5:4FF9E97CEF569C059704486FFB498DF6
                                                                                                                                                                                      SHA1:CCE58F7749AB1257595D3F84C8170218B7D2E62F
                                                                                                                                                                                      SHA-256:C909F9799A84653ED3A9FE178963475AA5FE81D5F29CF4DE6B67FDA000C8E429
                                                                                                                                                                                      SHA-512:FC5F8B2736D97E60BC1D73E56C5C0F7585B7FC109DDC59E4962D577C518A4C4F5A342A7CDB2C96F579E3FE814BED123B42770D8D3A3929C3C02BB58A06B19961
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........._.Ef1.Ef1.Ef1.>z=.Af1..z?.Cf1.*y;.Nf1.*y5.Gf1.*y:.Af1..D:.Gf1..nn.Pf1..E-.Df1..E(.Cf1.Vnl.Gf1.Ef0..d1..nl.Zf1.s@;.Lf1.s@:..f1..`7.Df1.RichEf1.........................PE..L...K..P.............................i............@...........................9..................................................... 3..\.........................P...................................................H............................text...%........................... ..`.rdata..............................@..@.data...P3%......@..................@....rsrc....\... 3..`... ..............@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\360mwapp.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_address.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):378
                                                                                                                                                                                      Entropy (8bit):6.911583061847822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDskGDVJn6dD0B3hFP/kVKqOk84kTfhZDXLk/MP+6yTirUp:6v/7i0fLkGRJ6dcxFP/kEdk8hjDXLk/D
                                                                                                                                                                                      MD5:CC56FDFAB4489EACA44A27143AE9AC2B
                                                                                                                                                                                      SHA1:FDECDD5969BE0F89500C6402C9C64B202A6DC4A4
                                                                                                                                                                                      SHA-256:163DB940619596F0569EEB0B7817C799C301E9270C3BDF85445F0871C4971E1E
                                                                                                                                                                                      SHA-512:A8BC28ED92CABD4D8102CF57A54EBB1FCF8AE2C9E080BED37D56F5BD156BC9BCA5CBF3007B66C0D86815099ACCD82DCDA900EF0169353267C82265E36C1554EB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bb``.... .OE..j&..++k...@....%.*...3.{.........Oddd._.~]../........[.y?.....?..,C-.A.d.g.dTTTd.....~...@m...AXX.?....-.....L.H.... .io.....,......L3.@f..`..T........hb..l..n.+...C .A>`.V..MM.j........?.....C\\....J.(N.Z...............k.zEEEjz...w......Y.D.:b....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_addressjk.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):375
                                                                                                                                                                                      Entropy (8bit):7.137923455086985
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDsxHtqeQHf9FBo4ftBb++V7QJxaqWnF9xxY/51EGzHsDgTel/Vp:6v/7i0fLptq1H1FlBbiPgFmv7SX7
                                                                                                                                                                                      MD5:679EC2BEE9EE3A3E175C191B57D6809D
                                                                                                                                                                                      SHA1:C65ED05227FB99A41262D93802FFB246490AE146
                                                                                                                                                                                      SHA-256:2A35A97E93752B96878C801B678E126656066EB919BC39A07E7C0AA03746950B
                                                                                                                                                                                      SHA-512:7DAB4E8C67990336473C7CB1F9BA782E42E352182FB424E3582BD82B9C7AD0C16D4CB845D933E5A79C4A8A1568AA38FA3AFF9EE838900FD6BBED8708573594B5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.@..G].......#.....w.-.Q.=...Az.s..9.A...6...-y..@:._..};3...Xa..I..+s.,..s._.,;.Q..l.}.&... ..Q...a.8..u]......P.H.T..H.DVUu1=.i........4...Rl.1....m..M...;.......q.m.....[,.QW...F..qL..K.F....(..o6......e.a.8..e.....9.`.....`x.?1C..OM.P6.9..0.1.f..2.;....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_bottombar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 28 x 70, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):895
                                                                                                                                                                                      Entropy (8bit):7.736770296459366
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:sS89NJziudHJ2OsjhS+lxn2EEeSEO8aIW:sSUmSHwRtSZoW
                                                                                                                                                                                      MD5:110D93BD46D87E3F9F2C22B984319BE3
                                                                                                                                                                                      SHA1:F4CA5A7E2838D4DBCA6B8E5A85FE31C368792745
                                                                                                                                                                                      SHA-256:F08DEEBC0E0573FC0B30C5F169D7912C3EE683578CBB45FB8CC5273E56A17108
                                                                                                                                                                                      SHA-512:92D7C5D1C644EC2C7EB18EAC637F327437980225B3C7DE0FDB3EAF4DDCED12715512EF3EEB4682DD6F4A89F29473F70B57B5BCBDA77549809AEAF53279547CE7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.......F.....PzcR....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..WKn.P..0:H..z....O..^.f..T.U".0./...<rfHJ............/n.~........Ao.......#.>J...Z(..~....x...."....#...A.........).gt..1...s..w.Q>.*_B...3@...h.H?...{..W.}FH...3.w...(.......+.).hK.JX[.(...r....l%.......7.......p....2.@L..hE....iX.CU...H]Q..f.A9....W...............-y.-h.XB38.8.\.)Z>........9.\n....E..d.(/...a.....[Di._....a;.........Y.i.R`o.b..4...$...%.....T.J1..M-r...QN3.u...@.5......*.d...7R..6Y...L....J....^.tO..1..u......].@.l...U..k}.U.*A....[./.y.D...............8.d...6$k9.@F.S.m,.4..d...PT..."m.[EPu..q;......:.kyk...}.l..P..K..6....".{3J}.w...^K..4N..L`..P....l........}+<......r*Y.2z.$..)....:o.$*..+V#...7a7Z...S.%6....T0.P..0(.6].>...5,.|...2..r764...1a.vf..*.bjwe.....g.R..v.`~.m9.9.`..`..=[~..{..9Od.._..h...N.9.w.GG<..&..D.. pX......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_combocool.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):923
                                                                                                                                                                                      Entropy (8bit):7.656747347784116
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:XiAybG+xVng2RZGlVvsbZ/2AxC0hchImNd:XinHxKEZRxSd
                                                                                                                                                                                      MD5:66E91EE2905FBDEAA4E5C2313B8FDB13
                                                                                                                                                                                      SHA1:B844EC343F2268ECBF4BEB0CD4D15D3033D2B17B
                                                                                                                                                                                      SHA-256:E787531C78ECF94B1BE9166E1667F41D9BFCDBBB771B9CA9D97C02384287761C
                                                                                                                                                                                      SHA-512:943526A7CC15571AA8E37301D839FB0762D0E4F25D0B44B983A192A480DBE6C09F8FA870528119C8BB6D3ED9DB7C6391DF5EF9A9060C475B1989711E99648505
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..KK[Q..wn...VP..B...HEl....$j....I..t"..ZA...-8...:.C.*.....5..uZ%.....=.!.....9g.....9...J....`...A[$.i9==m....///s."....5.L.........ii................M...V.....H....POzk.HNN.....`...f...v...r....;!.........@........[......@..f........z..w...2...../......H4.....If...r.....C.rZ{zzBsss..@###.....ogf.+I....X...+[IIInoo.......#..{}}.....jP...F.\......{{{}....yJ`.Im2.E.B...s..?.0.P...n..k....:....Dm2..I...qZ`..@.6..NO...A.x...fu`.kP..d..!XVV.s..(jR..d....p......Q..d!....j)//.....BQ...&.X...RQQ......UH..5.EMj.!..y.......s.n...*....5.H......@._477.9_[[S....l.A.61a.....%....SSS....V.......`P...1a4...J"..X,.q8....$V..sqq...........ZONN...u..a.cTG....0....3..........ZUU...$......Z...i..j7|t...@*.....1.....P.....8"...............z:.@...A..0VO2.([...D+,...>...._...!..4.5w.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_combocooljk.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):888
                                                                                                                                                                                      Entropy (8bit):7.608052775689205
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:wPD5/xB8ESjaqJDjFthuOB1tn9i+ez3eiJqsGNU:wPF/DBSjhpFvd1tqeiJqJS
                                                                                                                                                                                      MD5:B0A2B5855260AEBA0BEA2A6AF4421167
                                                                                                                                                                                      SHA1:49679525EEACA9A97D910F6F0904883838E3D2A1
                                                                                                                                                                                      SHA-256:5FF7AEE15318830BC40EA1402131AEDAF8CBFAD2AA914A628B5BF1D4B59703AE
                                                                                                                                                                                      SHA-512:5F9C579666EEC68A1873469B010DA5AE9739BFB8326EDD009C9D795F4EB0BEB39C4DBD634B9577C8BD3F8D5EE3CFB9CAE492A2A4728A0C49FAE969E43E216A82
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...OZa.._^P.4...A.W$!.J. 5..B...C...X..v....P..]:....4.!..!..#.....yn..i5..r..{........`P.E4.ex.E(.....N...M\^^.noo.777.ZDL&S.h4f...6......c=.Ln=.h~~...;....)../..............WK)EKK....Z........Z...O.b..'...._......Q,..........eq/...A-j>...L....!..B\W....A-j.,,<@.y.F...l.......I.^...v..uu%P.C..MOO.O.R....0.....!0....I.B..R#........wvv......m.z<,8}..../...d.T*..4...Im..J..Z.a...T.....d.V.A...`..cS....X.~....=._............@..V...lj{.....&.YdWW...hmm....d .....0.T.F.NK........}.......z.6.!P..5.........-.-.|>.6..w.jR....b..`..../.f.|tt.vOm..G.D../"....###..^o.a...V`?.f......~..6.s..Y<E..LZgg.p....ccck...."....c<..,...\.7.a+.....K.Z...../S...!.N..............vee.....K..k....V.j...}%.#.4..7...L..g.|...Lq..H..!..[..."B....j'.(..=n..o..Mv..`.S.}s..g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_menubar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 400 x 25, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2902
                                                                                                                                                                                      Entropy (8bit):7.854538720952291
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:U/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7pz:USMllcHitlIxv9vk7C1+I4wWHLihk/xl
                                                                                                                                                                                      MD5:EBFE7A6895A10C867E4178A8F34E2450
                                                                                                                                                                                      SHA1:F0DFEB6F1A01CA08F83A98F194DC7052F1913CBC
                                                                                                                                                                                      SHA-256:1D6AFBD5A688698A73C252089C9EBB8E5DAEA31AC2F701C7E7FC52B1D207E640
                                                                                                                                                                                      SHA-512:057DC9A7E4E60560BC3564B658FBD7EA9448C4407D64ECABCCCE32C7F8D13912A279C6A836ADB571CFC7B04DEB1D3C85CF56E1DF4741B92A6991395D6B161BF5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................?....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_titlebar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 180 x 23, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2944
                                                                                                                                                                                      Entropy (8bit):7.867012956447315
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:j/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7up0:jSMllcHitlIxv9vk7C1+I4wWHLihk/xR
                                                                                                                                                                                      MD5:E7854C688AFC786BF49BDD6CE61521BE
                                                                                                                                                                                      SHA1:DEC0B971F56FF413262E4619E1610975CA6D2846
                                                                                                                                                                                      SHA-256:5A0819E87C40D4F548301F601A44DF02BC4D2E8AB1AF30D6F7AB76C77701BAE9
                                                                                                                                                                                      SHA-512:A8304875C2DF8C6FA2C8CA9910A867FA9285519FCA055ABBE344FFB7C61A49559ED29CCC8043666B539E14B6E6F0214B40E082BDE79AD17C58A99AAD3BC346A9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............-'.%....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\bg_topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 480 x 127, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4458
                                                                                                                                                                                      Entropy (8bit):7.848831874056026
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:n1PinBKex0NHeZOJnKb2tUsnL6xFRiljhz2kg+F2WLXbgEmtXKm6YYwI:1KBKexBOvthsRi9hz2SGZu
                                                                                                                                                                                      MD5:4F1705C49D8B08621D8F47D6868CE563
                                                                                                                                                                                      SHA1:104C2E7DB170E423D34892366548C3D9FF3532BB
                                                                                                                                                                                      SHA-256:27F4DC9C58C766D8DEF55A8859DB30DF28168817649DDBE17E710A7A72606D8C
                                                                                                                                                                                      SHA-512:84738EC8FB0AE48554E81D427B537E1298C4EF3C9EA961F8E8E05ACED7284C3FA333F7A87B65C785EC03E60342B7E73C179E4DA5F41B4572DDD9E754BE511399
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....7...Z{.^..S.....O.?xO.=(B.PT....;..:i..R.v..Y.O...#...H.G~.._....z._....".).b.K..[..{.~.pEu.G.....v..Gv.EnY..H*.v......vU.U......[...+)...).\<-.h*J..J...-.t...].>[.{.).-.(...m.T .&...w.....z.,h.B.....,rQR...n.r.;.ii.\.\.t{d.LOP..hV.\..^9...4C....h.c.$....;I....N.]...D....K.$b".k"R9.`.n......b.RwS....R..w..%C.;.V..v....I.g..t.$4.....S_..4Q...!..d..Dkt...^k.w..$.w...!SdzR2..r...1\\t.e..tbh.?...^:.;....Ly^s1..E........rK.u&.9...cd.......<...lA.....W[..i..y.%....8-a.<..!.!.5S^..)m....6-).uqc.*[Yi........J+..m..`+MJ.._E.U`b.*Y.Pfqd.LON...Zt...Mm..V]..rcXa.&h.[.%).t...{.a..V..K.K.~.$n*H......5.<;f.g..5..s..c.l...l..)..5kv.{..3.....W.+?..K.M.....x..k_.....q.s..V..o..;.P.Yz %.P..f..{.eR.d+D..Q.2..E'Q.ce.l.L..."I.b.c..!SdzZ2..4..f|)zHRy. ....i&.T.=.(f..o....sb.&...Y..-$Z.!f1j...H...V+.......z...l..`.k&...IfE..^..S.R...1/p.-.s..V.ii.<b...P..E..7......UI"....G.z

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\btn_title_close.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 112 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4388
                                                                                                                                                                                      Entropy (8bit):7.912014293635645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:oSMllcHitlIxv9vk7C1+I4wWHLihk/xJCb32oVZBfXtLK5e/iEuV:oSHIIHUCD4waDS2sffXt+s/uV
                                                                                                                                                                                      MD5:D4CADB6C7F66D6EB63524A4140CA1871
                                                                                                                                                                                      SHA1:A00C017C57AC0BB45A2CA62F7E42AE17A02B96BF
                                                                                                                                                                                      SHA-256:B5DB14B67EF9A65951B5F48F88BBF1F9BBF860240193AB67614D09BD34CCB2BA
                                                                                                                                                                                      SHA-512:06350530B94C26D30A0B24D1320071D3DDF27CAA30CF442EE64DDD0AF962FBC964C45BB1CC45E1C47D4870891A474B4AFDDDF5927701C2EB400E92B071922E64
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...p................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\btn_title_max.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3741
                                                                                                                                                                                      Entropy (8bit):7.899231445675867
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/xKsCmeJ:2IIHUCD4waosiJ
                                                                                                                                                                                      MD5:A23B225B6D0B54B8DDA157047ACE3A33
                                                                                                                                                                                      SHA1:EE403794BF7D7B6FA7FD34FAEE982E08EDD9A5BA
                                                                                                                                                                                      SHA-256:D5C219976828E95119B4EEE98EEF949E0D2B451B03097D0BB51633888F784A73
                                                                                                                                                                                      SHA-512:B5FB8038993647D1D4A6618D11AC6C6F156CB8A1E8F643B5241E7C11C567D80ED753DC05AF00F6704782E40BB1746CE42AA3D9B34BEB59CBBCD321F4D9303010
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\btn_title_min.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3354
                                                                                                                                                                                      Entropy (8bit):7.890717225229663
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/x/eiGKlWXbp:2IIHUCD4wadSKG
                                                                                                                                                                                      MD5:30304F398F360D180CCDCD986F0E4D52
                                                                                                                                                                                      SHA1:5840F5D00051B44B4666373711FF3D5C5380CA17
                                                                                                                                                                                      SHA-256:332E9605BB588B8113167DF564CD0A4463701E60526EFEAB0575621214A068EE
                                                                                                                                                                                      SHA-512:C111BFE0C6566FEFDFFD107DD4BFD4196EE4DFAE87EDF0270FE3397078769EA34B9A2A44BA6A42D65A628C847B95D67B6E328AE86F586E625A02520932C633D1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\il_statusitem.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 208 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5267
                                                                                                                                                                                      Entropy (8bit):7.956195186420475
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:finFlEbEhgZPgh3wBAep5ljSECEDAUQCUuhPldTCzpslcfMl/Bf:firkMxEAwma3ldT2aln/Bf
                                                                                                                                                                                      MD5:2CFD765005431ADAAC5CA4C9FE73ABCC
                                                                                                                                                                                      SHA1:99A1ADA7BE44393E827E9959C536C39043CE6637
                                                                                                                                                                                      SHA-256:98C36162E3F977B1AE6E68CCEF6A6541ED2CFCB6FB455E53CD24D1FFA7FE55BF
                                                                                                                                                                                      SHA-512:2AF338B4AC2A495314E5ADD13C36AA2FC40D6929C8EEA77B89F06FE5EA00986A4BF4543DEC7DE5C19F7E16737A4AE50693663E8CC80AC4A996C5C5AF750A8BA1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............gL......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...%IDATx..Z.xTU.~.d2..))$aR ...`(J.T.....?..,....... R.].D ......$.l.4!B..$.J.$...s..3.Ld.g.}.=z.....)..}.w.\........~^....Z-...r7.CmueT.B6S..2.'...;...57T....F....!..e=..@..L............"...m.U.pa.^......w^y{.{.H.......W**...J....x.X,..{K.[ ......L.....""!..C'....V.Z%..l....7E$.......u..M.6..........e..aw....t.9l...4..Y.....4...@dP.Z.......o.......B......I.x]s..S.....^..l;..x...h..,a...#.....f.Xb....L.Q.xh.n.k.y'O....8..S.=.O......[...o.:.U~q_.."...s.....G.9l=.h........=.......9.y.f.X...1c.@....^n.5X......a.l.m...e.?...&..b.....{o..c&..........d.LH..FL....).l..OO.?....v..0..$&..Iw......t.w..H.8.......a....kG.Um=v4}..=.O......j?~.]....D....}\.Y...y....'.,Xp[X..i1B^p..)I}..+.&..*U.9..o.c.d..7h}...B........&)........L.;w...co.wv....}^t..z*3}Qg...h.T..MM...-;.1a....7I..K.......i.3.'.P"..L.Cll\;.........1IPxU.6....pX.`kT.Q.bL<.m.A8S..j;..q....@U..2.LiT.>s.:..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\img_sideband.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 4 x 49, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):158
                                                                                                                                                                                      Entropy (8bit):5.71235322396329
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlJOtEll7ncl0tRthwkBDsTBZtVdEAX22SQPx+PhitB1p:6v/lhPatE/gl0znDspVmATEPAtjp
                                                                                                                                                                                      MD5:5118D10C7EACE902540AC439524318CF
                                                                                                                                                                                      SHA1:4E077F9814418BFF4180EB0EE01846739D8524B8
                                                                                                                                                                                      SHA-256:1A4D1DC5012178110061C72F88B019E59428744D5B98FBC4862945362ED217E3
                                                                                                                                                                                      SHA-512:1AE78BB7A49E49EAC6CDA168202C35C3B7706DE545FFC89EF765FF4416C4EAE8D205DB7EEA815810F53284C71BC67F5FFB0E83A12C417BC909F33090F4DAF051
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.......1......F.`....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...0IDATx.b...?.2`...W...t.R.\@]].AOO...qT..Q-P..`.............IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\size_status.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):211
                                                                                                                                                                                      Entropy (8bit):6.330054257939168
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP8AMzl0znDspvsKhlyVQ5Yn3xJRyr+px/bGX+lVp:6v/7kAMpLhhlyVQGhny6XEA
                                                                                                                                                                                      MD5:A5099D3544E5202E9AEFFF353DE2C999
                                                                                                                                                                                      SHA1:026DEA383560874AB38DA3E192F2241E3CAB9F60
                                                                                                                                                                                      SHA-256:6FE17CDB2AE87788220F6D44551A6918111AFA6D1DB20E0BBD050CAD418DC7BE
                                                                                                                                                                                      SHA-512:09F87D3D4660BCAF98AC6D9CBDC24A59230FF4A7724C2317FEAC61D196EE360A87A1270A1C4C8FD41B6EE647D767E7BAFEB55EA1C517B962460BD33F78FFDD02
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............w&....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...eIDATx..... ..@$i.:,.h.7..F|d|.x.nX......^k.Wk....).L..8a)%......Q..Q..y.#3...G8;....~;.p,........oO........IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\skin.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5489
                                                                                                                                                                                      Entropy (8bit):6.585852073568794
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:0rEQE5pOV22c4LeR4Vraj7mKZTM8sAT8BDRYknQloo9AoIkKqIy/q:0rEIVxc4a9jv9Zoo9AoIkKqXq
                                                                                                                                                                                      MD5:E1398061A627C60593085CC1386B6C68
                                                                                                                                                                                      SHA1:647E88E4A8B910229F8C7FE76F2D4B783FCFD648
                                                                                                                                                                                      SHA-256:B65FEE9AC2F2115808424515EB04E5D0FA10709758CC7E95DF01D355CC00D5A4
                                                                                                                                                                                      SHA-512:AAC734FF7C9F0A8032365F57B8AB861F096A9FB3BAEF0EB32616FADCDDA630082F2683A48C2E6A790C738D745B2B9917BC2ACEC98CC6A695B62EC7528ADB569E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:#read only..[General]..Name=Azenis..#.........Author=JJ Ying Create, Breath Modify...#......Comment=A 2006 GUI Champ Best Overall Visual Style..#......Version=2.0..#......[TitleBar]..Height=23..#.............[SideBar]..Super=0..AlignSuperTitle=1....[Rebar]..GripperCX=6..RowLine=0..#..................0......1.........AddressButtonSpace=0..#......................SearchButtonSpace=0..#........................[TabBar]..ItemLeft=12..ItemRight=12..#.............................................#................................................VBorder=1..#..............Y...........PBorder=0..#...........................[Browser]..Border=2..Spliter=2..#............................................[ICON]..FAV_DIRECTORY=fav_directory.ico..#...........FAV_URL=fav_url.ico..#...............ADDRESS_URL=address_url.ico ..#..................[IMG]..BTN_NEW=tool_new.png..#...............

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_bg.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_bgb.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnclose.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4467
                                                                                                                                                                                      Entropy (8bit):7.887524585572367
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xwfKkLVVi/xMQye6DWfaKl:dSHIIHUCD4waWRVVwMCnzl
                                                                                                                                                                                      MD5:D6C5EA4C704DA7C98288EEAE2C4B668A
                                                                                                                                                                                      SHA1:C55548295A566EDF4FB1047D6543CEF93AA7D792
                                                                                                                                                                                      SHA-256:FEB9889385BA65246180CC47694BE22B81344B4141383C1F5DEE565C249ABF84
                                                                                                                                                                                      SHA-512:004EA99AD6027AF356A7CE01ABEFEC9514D5BF2ECF275B1A72C0C44F631EFE10599CFC0AF48DE06516C2784D56FA59D406C8AC20DDE5C285EEB7EDBA93279642
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnleft.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3641
                                                                                                                                                                                      Entropy (8bit):7.901710647211874
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xQJWHAFfvUmyhpy:dSHIIHUCD4wa+WHAxhOpy
                                                                                                                                                                                      MD5:B112B85C2FA8B2520A5F0D5D63E19E63
                                                                                                                                                                                      SHA1:991841D56BEAB6F9E01810510C14D18EE992C5F3
                                                                                                                                                                                      SHA-256:EF7BE34F2A38FA86C0A01A65CAD72AF086105EBAE136F0213BD10F86022F7473
                                                                                                                                                                                      SHA-512:45EA3B364D7E37886804067D160A3C066C038393D2FAD55A18DCDC65D3A58E38903AA1F41D8455887C4F4A9AE069E3478753E4180184E99C602B05C135A563CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnlist.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3429
                                                                                                                                                                                      Entropy (8bit):7.889410060546279
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xE94bNjeIW4Ntv:dSHIIHUCD4waRQInD
                                                                                                                                                                                      MD5:7EC39872A2DB36E8915D6AA8E2F881D5
                                                                                                                                                                                      SHA1:224A440E2B0660EBCC89C3AD9A880A08F57F7D16
                                                                                                                                                                                      SHA-256:E8FF2A17DC40ED150B1E53331C131190D7CA3ECDFBFE995E4226099BD66FA406
                                                                                                                                                                                      SHA-512:CD32E9704BDE2462F2B411489F5DBFA974E3D00B37A0C81EFD524F2E006A7773F4A2ABBDC9AE9363E3C20E63DD54EB550FC3E8BB574496996A171B0AD8703E5A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnnew.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):786
                                                                                                                                                                                      Entropy (8bit):7.546808003957644
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:LmaCT4VwffCMlEJ/ocRnaqxnZVXPcs20C3naWrhlm:LmSwffPyJRaq7VXP520C3nbdQ
                                                                                                                                                                                      MD5:0B08617981E18967F72525470CBF3E77
                                                                                                                                                                                      SHA1:2A79C7EADB99B2ABE4BACDB534369C9F048AD37A
                                                                                                                                                                                      SHA-256:853D1856F1BB147DA4F791C187FCBCDD70A677E49585BC01F9FEDCAB297A6567
                                                                                                                                                                                      SHA-512:86A4D861645EAC50DFE068AD5DB567FDBDCED333908A24BA2AC1AF40098971F6636975615309F6F167F3C3E7503F912EAFB60DF29E75360155BE1F0FEF367052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...`................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ZO..@.....<$....."^.R(.)...........=..So...~.~.^\X(.x.\*TQPH.....4....d&..<..A.o~.7o2...n.DrPe.....EQ.7.fS.....t......D.N........X...d2G...P...r.?.tP.#0..7W.Uw:...pH...D..:)..$...M..I\.......dB....m;..a..R..B.@....t...lFF.Q(..R..r9....V......~....H..b..j5.`.....{..kn...z.....i.m...V.0.h..h..=...*.....(..@.G->..p...y.....p..y..-....@.#vx.\.>.......py.Hl..A3..x\.&h.....q..../.C.9@B.9.X.....W...W......Z..oo..G.v........E.Ae.^...._....F..D...K.........8bc...w?....;,.<.._.z...>.z*.....?#....H6v...........?......>......gc.W.%.....0z,..C Z.......R...._..X..M..xQp......8..l.8..;..Q.....v9.X.l.....?..D.>u...C%.......(..%W.4@B. ..H.......s..E......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnnewb.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):305
                                                                                                                                                                                      Entropy (8bit):6.175730934146871
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPkl/O/6TMMAYfvl5uUdHlOx815NwNYZbbhEzNoPoopj32OpXp:6v/7UO/6TMqUwEx81/Z/66dcAZ
                                                                                                                                                                                      MD5:0408523A403C234A6FF5A73AFF360BE9
                                                                                                                                                                                      SHA1:309304547079031CC9A7FF87C52BBD55CB82A68F
                                                                                                                                                                                      SHA-256:4EBB1B2E9B7C5D035637D980BD08C67DB341B8CC1C3337E7D07774E2650CD1DA
                                                                                                                                                                                      SHA-512:92C3D04F97C402BDE63532DAD510BB467409591BD140BEC0665952D49653352F577B0E3FCAC7B5FAA7964EC81324B6EA67AD3AC0F823AEB52C7F25868DD2E778
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...`................pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx...1..0.@.x...8y....G..B=.....P.B. %.A..\~J...I.1......@.. ........l.<|.O..|..C..?>i..m>.wz.....l...M.u..g.DM....Q...=sd.$H.......?$.6...@.. ......@._.........0/V.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_btnright.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3664
                                                                                                                                                                                      Entropy (8bit):7.891018711426157
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xjntMr/R:dSHIIHUCD4waRntMr/R
                                                                                                                                                                                      MD5:716E2DC65E20E05219E10C230783356F
                                                                                                                                                                                      SHA1:30B0C796C5AD8D3B623F7D67F6F974F07A61FFC9
                                                                                                                                                                                      SHA-256:1F2F895C8E4CA97F21B31C0C6403AACE8F4339D92980B7A79B53B375CC85C8FF
                                                                                                                                                                                      SHA-512:A137905D889304948059647ABF87A1623321A01246EE47E8B89816AC49CD69927D1D60C0DCC52F408F0C413205AE637E2B3BAAB75D72D4DFF2C1CEDA6FAFC26A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_close.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3914
                                                                                                                                                                                      Entropy (8bit):7.895999769181624
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:ISMllcHitlIxv9vk7C1+I4wWHLihk/x7a8TnZO83:ISHIIHUCD4waj
                                                                                                                                                                                      MD5:0F48448630F47F51E9E309B7C88109BB
                                                                                                                                                                                      SHA1:60250A7CCB0F464DE5F3FFE60C5EA1596A997BC8
                                                                                                                                                                                      SHA-256:3E439DDDA28EC24F0DCCF14DC427B874439E9F7502F8FDB1315E9180DD949BCB
                                                                                                                                                                                      SHA-512:245F230F6AB9062E9FAE8E90703CFF77F22D2681C584B9CFF6D6B89FCA97E1C778B87530C4FF7ABE802973207D0DD00617082B017F6D820386CEF9801D881207
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...E..."......|......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_item.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3722
                                                                                                                                                                                      Entropy (8bit):7.899224106584947
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hSMllcHitlIxv9vk7C1+I4wWHLihk/xrXwL+o9qjbdc:hSHIIHUCD4waRg9qji
                                                                                                                                                                                      MD5:45FEA5118EE9A74839DF56DAD84F56AB
                                                                                                                                                                                      SHA1:A0D82C69D219CB8CD1404EB0166EF8B8C748B53F
                                                                                                                                                                                      SHA-256:43E59E4ADFE9DAA9EAD1ED41FA17C6DC8056EB14FBE41DE60F4FC7A665BC6E93
                                                                                                                                                                                      SHA-512:5ABD0174FEC6B8EC0AD9B0F38F52090958ED43837925F34A9136F9C60558B2C99203E9E13BA0761D2F486CA7BBD078D1CFF2E053B533A92D3100A6236C061F88
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tab_itemb.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2608
                                                                                                                                                                                      Entropy (8bit):7.882785296810761
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:TDsqWxNpSU9R+FkrZaM6UbI00CGGLS3fIOYHfmonECkORJGk56JFPxGjfknTGIh/:TDsq0SUHnaBCQCGOS3yHfdECN96JFpWc
                                                                                                                                                                                      MD5:178B8BDF1962943FB5DF07AA07A99250
                                                                                                                                                                                      SHA1:A8FE3CC3BDB2F33751EEA61AD8717E00FAD4546D
                                                                                                                                                                                      SHA-256:78FE192F2FF86421B48ACD46BD1CD78D319C47007ECF4BECAAE4F4B82C86F074
                                                                                                                                                                                      SHA-512:DBCB024A2BCCF977AC148F8D4E5923F181ECB217B19DB775CBC9F4668CC9F31B0897BD816FE76DC98684EC6D9316F573E1EF40D14D94E3A79EF40D9E3CDF8395
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[Ko...>w8|./..%.l...70.....].(...MV.......?h.n..@..."....]4M...$....%Y.H./q...3s......aj....$........sy.I)a.f.M......4k.....Do..`j..>K.cd..<B(.h....b.g.Y...8D..Z...,..%..giD.....Ek).c<.D.)P.F.....V.V..hy....(.....F...m..5.:.x+...,}..3i..gVM.@...wZ.......5..j...!HJ}.<..khw.^.pc......g.J. .%N>PN.B.L..6..*...f[.?..+.....DqS.0.J......8*K.]/.g...eV...O.....i.Z..x.!.....9...........Y.)Xh.)........}....w......&...+._.P.No.../.7n.....@G*..@8...\~i......-..P,.H...GW.4.....n.uXn....|..5.0~.}....7().s.....T^.....x.B<ow:.).....y..g......o......a.....`.",WJ.^_......4.....I`...+P...u.....w...?.vk.M..h..&........7nf...A.....r..|v..>|..L...ad{G..?.D1....#.S.....y.x~...}.$....:.X7...v..7.C...;.\.8.}.8.S."O....4.D.\..o...^.....-......;v.J....B......u...5....S.s.a.........T.5.@y<....<P...K...Pa....^..A...R..y..@..+M..vHd.6........|>7..K........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\thumb.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 60 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):518
                                                                                                                                                                                      Entropy (8bit):7.326106620215251
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7GLcAAqRUUpp359ikkBi4Q8pnTZtEWUQqBugrt/73:AAF3/359iq4ppTZtBPtgrtj3
                                                                                                                                                                                      MD5:A19117ABBC4882C42E88A2C6ADEBBF80
                                                                                                                                                                                      SHA1:A1939BE01CB3818BE8C4F37730BAD3E68504BFC0
                                                                                                                                                                                      SHA-256:432616E5DE7157AE72488B761F15820841111E261588404D6DF558B15D80AF50
                                                                                                                                                                                      SHA-512:6F2C9B881694FD621DFBB418B45953D132D21A8989705B406A8FE9F543890145167B1CAECB36DF690E5285673978CFC7A1983D9836FB93CA49E875C4CABD447B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...<...........?Y....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.H.L.#..zx........+V.S..6..'\....T..Ak...ZTv.5..a.*;p......8h.yX......@i.t..?...b...3|......`.....gg.x..b..4g!.....?3|..........M.y.z..>fgg.?x...gNI.............RSS...999.W.Z.i...R_.....W.--.g...d../B. ..A..I.;.....?{..=...4...i^hX......._2.....Y.."...../.^.d.6...t. ......\.........eff...rp.WRR.....b...hKk>.[Ft5o...Hmi.r.JW.rss.N-0._.....y0._.....y..C<.....G=<.............(.F....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tool_go.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3112
                                                                                                                                                                                      Entropy (8bit):7.923572389677524
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:n37DTYmEYkOTrzGzTb40tllVYbG5DCAatTSytJtSak48ShiGJjAHs+zn4YiZCXEI:rDuYbITk0tllVtdCAaH+aXNhitCA0Qnr
                                                                                                                                                                                      MD5:8617CC17BF0424619372F86C37EAF521
                                                                                                                                                                                      SHA1:FA3F25348D619320F7642732A925B9875EFC077D
                                                                                                                                                                                      SHA-256:C474475EC789A4C47972015385A8D6AA74289A9B6A995380CF32940E9ED0FD54
                                                                                                                                                                                      SHA-512:E716D8B66C2CA7D55C1B3B133A8CE821F9DB9164FE6F4B20F763B2B60CD8A2182514E7CA781C7C85C9B8AA8CE4FE787664BF8DD34344E5B22CB5B2D896F035E0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.o......v..v.m...).i).}...XS1........a.~.J[...........4...c..n%.+m!....&m.p..N..........$d.l..Gv._...{...s.l6.....p..*...%..&..`....A.."$.1B......$.g.E....q9...i.<.P..`#T.j...B+.......c.A.9B?.O."..Q..t)%~).X.r.A...v.6.V.[....}...>.x.U.-..1<te...........K.WwF.....e$&>E*......mp.s..7n67m..]s...$.....+M-..Us.PR....u..]k.b..5p..U;.V................... E./Rq2......auS.....UU2_8...s...ap.#....H..s.P....\............z../...;.Ago8C..'..|...X..ZR.....GM...h.s..Z."....82...j....,V+..j..C...p..{......7...........}.9.p..<>..Y,...'...!....>.....F..j....5.42.3v..X.|.....e.[...+..JL.%...Iy..[.tw....j...H..3.9.e..4j5.f+\u.........CW.u....<.wp....{...^.p(H|.9.T0..p.............._(P.J.y....,..;..'.E.>.[.#.._...,QR.pY......-..w...ys.A<.@".(...D...a.J.{...d...@9Kd.m....;s|.>.<.B......g...@.%j...k.Q.<.G.a..{..|.O.@.h.I.x.n?%\.b..e.bx.WU..o.dRB,......_~..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tool_search.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3841
                                                                                                                                                                                      Entropy (8bit):7.936794890178898
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:EiU+SxOJqQDBX4FQYoxhTr/MWJThCI5dY/A7nSX2gKgQ6:EiU+SmXRhTrkWJThc/62
                                                                                                                                                                                      MD5:387BA64C9F45FEEF2E10A7ECEE89CEC1
                                                                                                                                                                                      SHA1:FB01461E47D36CBE561BBEEBCCC8A514082C5001
                                                                                                                                                                                      SHA-256:6813B8D9C948189546C6A2455836E1A125CA9962C7890882473C55AD4B58B3AF
                                                                                                                                                                                      SHA-512:31E2B9B5DBEFAA35B69B3F27890A11E6FB47DB346E79B3722ACAFBBE222A60CD7996B42E0DC56B75E6905EB41902FC5F9398CAD18809114FCDA29ED750365EB1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.P..u...d.....)...!.....$..L].r..{.i:.t:u..L3.&..N...t.I...T.*'...*....-...I...<..~.z..x..*c..&Wsf.....s.=.|.+.....8ZwZg{,!...I.$....^...*.9... ...K....}H|.#.u.O.T.k.S....'...d.d.d.4........w.$#$}$.HzI.H.$n..0dt.#~*..m.]F/....4....n.\ 9Nrhrb....Q.e...c...1.'...F..........<...E...#..M,.!/W.S...X...d.6evy7=.+.9....^.Y.#J..B.p,...$/.{eU.JK.....L.......Fm6.Zo...5...v..."CZ.i8.WTT......%.........uc|t.....w.....p<2..>!4.yj.uf.B.....:...P.......l.a.V(..G..;I.I&.7..=q!B..$.m6..:W.lAm}..r..n7...b...R..*.tz=..Lz.G...8{...SS[..|L.m6.;.[...>... ...`x:.22.......S'.011..........c.["..[..v....|..l.6t.5.._.QaL.1(....$.}..R..e.....p...D...9...A&.B...$....>v...nv...<..R]].{u..d...].........9.-..!t.^_..2.4.JD.Kz.[.q_}.]}m.>.~...Q..f.WH.)..Jz...y%...m..{...eu.....E&....`.B....q....h.*...Z..."....b..n....y"....m..<....F(.K.S..H......c..q..F..%<7.d...i<..........<...u.z

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360mwapp\skin\default\tool_sidebar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 136 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2980
                                                                                                                                                                                      Entropy (8bit):7.904587672083421
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:XVxfPDO/ZqAS1dE6lCxzZMG5of6V+QZ198lcenvmUL8e2UsJXk0nxGEngbdFJAt:XVxjQbwEACxzZMGN+QZ198m2NweCNxvP
                                                                                                                                                                                      MD5:E7FB4B50E574A0C6BCB91FF84A05CDDC
                                                                                                                                                                                      SHA1:71E7DE26218A926857D6D3F24F9A27FDB7627ED1
                                                                                                                                                                                      SHA-256:050AFEB2AB763D10D19031DF07F50E10C10A4A30EE969A9E755AEFB1FA4DB77D
                                                                                                                                                                                      SHA-512:F404316C768335C5F55EEAB567751975AD8C8253CAF78EE172FAF201F33790714E404F3028BB8C5316187492E035B938AE5C186023BDAF3D740A30ABDFFB8B5F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR..............M......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...6IDATx..[[l...>3.W...5fmc'`,.K1 s)...&..B..*.D..RHJ.PU)...O}h.P).MS).$/q...+..C..&...$P.16..efw..s.3fm.....HG3....7.|.._.1....#..a^.S.e!Jy.....Iv.\@9.6y.-..<...r<.q\.e.Vf2.P.....CL@...z...:.{......i.........)...+O.>}.0..W.P..],...v.~.....y...PVV.3f....8|.p .......P.r.,T.....-l...}.........Y..:...3....d....K]].a....QS...9..........3q...#G........h.j.6........O~....o..S..F..-H.RP..}..'....B..[.N...t:=l.>.......c...o...a..K.....4.....&...eY.h...=....s....r...q......_t/........../^>....f.....6...4..c....w. ..8..D.U.z..c.X....../.u/B............D..^|.y.....g(...,`. I.`...E......].$..;...q...O..Mi.S....H=.m.dy..W[0Z,B.e.0k+.?."....y....n9y.....K*}...Fxfs..psu.C.!....u]<y.M..]..Z ......b.*o5zs.F.E.r=F.......~av]]K......^..Q.k..As..s.... .w]:u.....42........X.|9,Y.......v....{.Bgg'.ji..?..B.|....g[..Z..n^..'?>............".. xp....yuuk.uu .SUU5..&.1.f}:

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\360wapp.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2055344
                                                                                                                                                                                      Entropy (8bit):6.501574992303422
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:7TmiYzj+x7bTWqC1QRmQ8KeIzHlyaZL3iY4AUrnGs/RLIHfs2lFfjErTztWCCwu:GiYQj5sIvFyeCZyHfs2Lfj8tW1l
                                                                                                                                                                                      MD5:2EF1EAA12A6DB2793C2981DAF6E5D885
                                                                                                                                                                                      SHA1:FBD587CF30AFC8CFCC6B579D31FD390E05E5A105
                                                                                                                                                                                      SHA-256:E0358A4AF7258EA9901120D18EDA96F027E879A72A9CB3E5AC3D9EA183916AC9
                                                                                                                                                                                      SHA-512:F9F0917DB1379032577D423674B69E796E9BB72144FC28DE5D86EDA473D8572E3ECF040DAF95CD20914C7E5F40387587A1DD060E632388AA82A4D5653A52748D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...h...'..._...'...u...'..._..n'.......'.....'...'...%..._...'..._..,'...u...'..._...'..Rich.'..................PE..L.....Q............................T^............@.......................................@..................................A..|.......pJ...........B....... ..TG..@...................................@............................................text............................... ..`.rdata..............................@..@.data....V...p.......X..............@....rsrc...pJ.......L...h..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ACS.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterCore.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1157120
                                                                                                                                                                                      Entropy (8bit):6.505465407208107
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:kMsqyPFCyyLIyN/VowTqLbz4nt9GIy9knbKHbgHmbq032Q7x720WNmrtYVhapjUI:pwPFIIy9uwV/NYsbsbqV0WMrtyDGD
                                                                                                                                                                                      MD5:3370C6FA90EFD8CA5C88E7DB8706247A
                                                                                                                                                                                      SHA1:1BA328300E3021DD1AF86C27E7E5A6436C4F1EDE
                                                                                                                                                                                      SHA-256:6D51C3DC16D1876CB4AC691BDB49C3D662F76C92F423BCBB1497B3D07AA831E8
                                                                                                                                                                                      SHA-512:E4328F0420807ECFE586E8BB597134C80BC107106BF41A5E35088706ADA545C89A81F199B88155BFA1EB30800DCDB80F9F2636458C03CA67942EFBEF30624A25
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E............................#............V..&......&...............n.......................Rich...................PE..L......P...........!................sw..............................................6W....@......................... :..v...l...................................X...0...............................H...@............................................text...L........................... ..`.rdata...J.......L..................@..@.data........@...n...*..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterWnd.dat (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterWndChildren.dat (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppCenterWndDisney.dat (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppSCProc.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppUpdate.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):209864
                                                                                                                                                                                      Entropy (8bit):6.5024107808001474
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:CA1daG2oc26b4J+kxQLuUWyEefSut5GgzLhsbeOjunR5+hGv7drG:Pd92oczb4lx5VydfSut5UBSnCwrG
                                                                                                                                                                                      MD5:4041E2D714BB833F85C49BD952DB8D70
                                                                                                                                                                                      SHA1:4BA4D999FF511D5295B5CD3DC6A83F55442C595A
                                                                                                                                                                                      SHA-256:B7E10B3B16A7E10CBE310C2213268467E63D2B50E1CC54754976CB1B020B28FF
                                                                                                                                                                                      SHA-512:AADD060D0BF73969CAF0F985FF8895BBA530E3968A0AC53D12C890466840ABE7A241E120F2BDBDEA23BBD62C36584419CA86A910C9A1508C07C892AEA1592B02
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b...b...b.......b......tb.......b......b......b...b..\b.......b.......b...0...b.......b..Rich.b..........PE..L......P...........!.....T...........Q.......p............................................@.................................d...d....0.......................@.......r..................................@............p..(............................text....S.......T.................. ..`.rdata...e...p...f...X..............@..@.data...\C.......&..................@....rsrc........0......................@..@.reloc..h1...@...2..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\AppcenterData.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):665448
                                                                                                                                                                                      Entropy (8bit):6.307152211676421
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:8ewM5egdD0nHwv1KDs4fU3Sd5H+pscGKsyClZ9Q17:H9TdDicDYepsJKsBQ17
                                                                                                                                                                                      MD5:2C6A3D174572D20AD836EA64CE31EFC6
                                                                                                                                                                                      SHA1:9CB1D008A248E6806D5548DD960B66C68CDE0BC2
                                                                                                                                                                                      SHA-256:C4DF348797791A91A3ECF05D1375CDEB26188B4273F794041A67A2FF4D50783A
                                                                                                                                                                                      SHA-512:85A1619C5458239044EEA9E4C56B129350CA4D7E844FD74648BFAA18705F8055E1A01FB34280746E3587092F2A72632B922683EB37BF0D7D7C8E7DD964F2709B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}=J.9\$.9\$.9\$...I.8\$.'...<\$....8\$.0$.. \$.0$..\$.0$..v\$..._.6\$.9\%..\$.0$...\$.0$..8\$.'...8\$.0$..8\$.Rich9\$.........PE..L...uz.P...........!.........v...............................................p......a.....@.............................................................h........W..P........................-......p-..@............................................text............................... ..`.rdata...5.......6..................@..@.data...XG.......&..................@....tls....I....@......................@....rsrc...............................@..@.reloc..8u.......v..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\BizPluginCake.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):198104
                                                                                                                                                                                      Entropy (8bit):6.617352366925133
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:WRs3qPoZ5nmGk66yCXeyqv79VDNLcYHrwDzM5d5sv0oSDnzBTfn5D8Xjs8:NfsBqvJFe2rwHM5d5svFG97dijs8
                                                                                                                                                                                      MD5:1A069A853EF0B9547D10C9E55624BA23
                                                                                                                                                                                      SHA1:47FC9336E7DCAF28BF699AEA213E87CD8EB349C5
                                                                                                                                                                                      SHA-256:A9E66ADEC4C6910A9A569F3EC6FD40B415FA37AB395C09C679DFF84C0D01DEB8
                                                                                                                                                                                      SHA-512:6421533452420A19DA488C7E1B1D24F59E9BEE7B70FFD898B361758B4444E284E2549A38E7ECC8D455A6A4A673EFE41DB60A778BB8E9689582096087C5FBB2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.V...8...8...8......8.....8.... .8.<XC...8...9..8......8......8......8......8.Rich..8.........................PE..L.....[Q...........!.....<..........*........P...............................0............@.............................................................#...........R..................................@............P...............................text.../:.......<.................. ..`.rdata..OX...P...Z...@..............@..@.data....:..........................@....rsrc...............................@..@.reloc..|(.......*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\BizPluginManager.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\BoxUI.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):894824
                                                                                                                                                                                      Entropy (8bit):6.52386078019351
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:FB/l9ImbX0RJsEZ1h5YC8kFjg4698fng+Ae8niUP6ZMlvj0+nduqpWTyEd7ml3:FFTgsU1YWEnEnJAloZMlr0vq4TRml3
                                                                                                                                                                                      MD5:8D42784F8758FFEAAECE44B131CD8C76
                                                                                                                                                                                      SHA1:455E4E7175EEA90C625EF99336856460DE77333F
                                                                                                                                                                                      SHA-256:378D1DAE7BA0C554F354586589F56FE818320C46537A1004475F902EC205B082
                                                                                                                                                                                      SHA-512:A5F659423112CA7C65DD8759C6C1E1DBB041F4DF9594FF0CB679652D03ACEEF17CC8CBAC7D2B9CAC749D6166B5AE74B0180BCCB82F323576669A19285C9AF7A5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................e.....e.....e............a.....w.u....p.g....p.....~......f.....`.....e...Rich..........PE..L...p..Q...........!................(........................................ ............@.........................0...N...<...@........S..............h.......\.......................................@.......................@....................text............................... ..`.rdata..~S.......T..................@..@.data............T..................@....rsrc....S.......T...>..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\CatchScreenTray.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):531400
                                                                                                                                                                                      Entropy (8bit):5.943047165437147
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:YAPBD8ItjByZ3JeByKzdA0CmWZyYNgHQ/E5g2HNnqOr7bg:YAPBD8ItjoeByQSMWZyYNgHnq21Zrng
                                                                                                                                                                                      MD5:5D769795FA0B32B7E7AAB82E6F87CEDE
                                                                                                                                                                                      SHA1:CF780D816C495758C0DDE8B96733C585D6269F84
                                                                                                                                                                                      SHA-256:74B38BFD569F1421F29BDB0D34F95ECE9442792376A337E45B98021CC4E5E37C
                                                                                                                                                                                      SHA-512:18A5BBA59FA14F1F6E772F6771E670BE9A1FC3581AC56E9444E2B56807D385F85F8FA663042CC61582C4B5E3C70AC76B43ED55A4C8185A46C45604265F543A17
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.QKe{?.e{?.e{?..4..d{?.l...{{?.B.Q.d{?.{)..a{?.l...C{?.l....{?.B.R.g{?.B.D.D{?.e{>..z?.l...;{?.{)..d{?.l...d{?.Riche{?.........PE..L......P............................qz.......0....@.................................Br..................................................\...........................06.................................@............0..t............................text...)........................... ..`.rdata.......0......................@..@.data...@........h..................@....rsrc...\............N..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\CloudTaskCenter_naive.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206656
                                                                                                                                                                                      Entropy (8bit):6.533353933032578
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:7pug/0vD2hdIdDNZ6oyY15afle0TK58x3lap:7pug/YKTAAoyE65la
                                                                                                                                                                                      MD5:BD0A2A0341F0C0CBE91ED912DCBB62EF
                                                                                                                                                                                      SHA1:7DDE8B27275CD93053D98EF3083B262A395FAFED
                                                                                                                                                                                      SHA-256:B4DFB4A0970548604908372F43783514D17C021C2AB65D5C12E61FB0B38C4B5D
                                                                                                                                                                                      SHA-512:AB390186B9190A29445BAC113636E9F613B3E4E2E77BF82406ADCF99EB1CCB10E1605C1D570A3522B15F1D723932F604E4422DB76749D57B7A9D635AA855593E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..k..k..k..,k..k..:k..k...k..k..k..k..=k..k..3k..k..+k..k..-k..k..(k..kRich..k................PE..L...F..Q...........!.....\...................p............................................@.........................`...........x.......................@...........Pr..............................H...@............p...............................text...7Z.......\.................. ..`.rdata..ZY...p...Z...`..............@..@.data...d...........................@....tls................................@....rsrc...............................@..@.reloc.../.......0..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\Config\config_Bin.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DTCrashReport.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):253616
                                                                                                                                                                                      Entropy (8bit):6.269768372575183
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:Luf0V9jblulC9FT2saGG1VLErK2RaqOv+TBRjp3L:Hug9FT251Vz2cqOv+TdL
                                                                                                                                                                                      MD5:5DC6B9FBC85018A912A166C5B7C6515E
                                                                                                                                                                                      SHA1:51DE39B4CBAF5F704464EF43FD89099D96A540B4
                                                                                                                                                                                      SHA-256:BAF48D4858CF440C64A617EB6FB0DEC7FA821A7136DA9D89A2FDE43CF09EB95D
                                                                                                                                                                                      SHA-512:A4FB4EBD7E5DD00C3CDC86A0F11100623348E57218DC417D55F625FA0EDF144971E39B60A040684241F6F4FE13D68397AC8F47D251F677A1E3A51098A4235433
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xzq.xzq.xzq.q..lzq.q...zq.q...Ozq._...wzq.xzp..zq.q...fzq.f(.yzq.q..yzq.Richxzq.........PE..L....Y.Q.............................+.......0....@..........................0......@-....@.................................L........0..@............................2..................................@............0..<............................text...o........................... ..`.rdata..L....0......................@..@.data...@I.......,..................@....share....... ......................@....rsrc...@....0......................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DTQuickInstProxy.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95608
                                                                                                                                                                                      Entropy (8bit):6.367483084267698
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:vLrdUPI24KL2zLaTRasZpLqCtQyZOUAkko5Rdj5IuwS5wCaD:vLrdUPI24KLbM0LAyZ1dj5Ic8D
                                                                                                                                                                                      MD5:9C25145409A526C663D25822A2B8201A
                                                                                                                                                                                      SHA1:4C22A4D2FF1450DC43503B161A44DC44499A4292
                                                                                                                                                                                      SHA-256:5EBAAF4478F9ACA39BE440E687FAB7614C1CB51DAF679EE0B89FF40EB741B825
                                                                                                                                                                                      SHA-512:78D6DE19AF8DF9862D0EDCE551334109A10F108D185596F8C36CC586F2CE9DC28D528888E153CC2D0F892A4B6D6A174BF693F2D39A1F7967ED440D54579EBA5C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..h...h...h......h.......h......h..J...h...i...h......h.......h.......h.Rich..h.........................PE..L....a<P.....................v......SY............@..................................?....@..................................+..P....................`..x........................................... ...@...............x............................text............................... ..`.rdata...3.......4..................@..@.data...`>...@..."..................@....rsrc................@..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DTShutdown.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):240304
                                                                                                                                                                                      Entropy (8bit):6.486048784542187
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:pWmcumWKrd6V0v2QiDv3kGeeL75oe8D8lhSOXYox0n72FspCMX5CBaaaakcDCkqG:znalij3CHD8lhBotaF8CMchtqji
                                                                                                                                                                                      MD5:6F712FAAF9EDF362136780C25455B1DB
                                                                                                                                                                                      SHA1:1A968BC1596B0CDC1A4E795A2EA662848CF2331B
                                                                                                                                                                                      SHA-256:9A693E0A675BFB8A4713B7822FFC608CF6BA2D4441252039C619FE345AD57E3F
                                                                                                                                                                                      SHA-512:E5BF190D46219DCEE909CCD6EF46168268412BED4686B11AF06E211B56106158F7E57FC03572293E3BA7728DC55F3B3827836D091DF47589DC13C206451F6EC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<@..]..]..]..%..]..%...]..%..]...C.]...U.]..]/.\..%..]..%..].....]..%..]..Rich.]..........PE..L......Q...........!................................................................i.....@......................... 8..h.... ..................................8(......................................@...............D............................text............................... ..`.rdata..............................@..@.data....A...@...$...*..............@....rsrc................N..............@..@.reloc...:.......<...T..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DesktopSkin\360DesktopUi.ufd (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\DesktopSkin\MusicIeBrowser.ufd (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\FenceDistribution.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ImportFavHelper.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):716464
                                                                                                                                                                                      Entropy (8bit):6.887338423237583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:SXobqb7txh0BHw/dq70//Le71eBSlX4QwfgW3hFHOnNGzjuzG/SY0ekSkS2L:Wqe7oq014Sl/wV3/HONGfiG/US
                                                                                                                                                                                      MD5:01E6C6FD97BF4F23D3CD5BE9E4BE53DB
                                                                                                                                                                                      SHA1:F691E5EF40701BFEF9BD88FF50B46E2793772F8E
                                                                                                                                                                                      SHA-256:7FD2A1A53E3EEB2CF446C611BCE1DE50E26B6E46680520FFCD0465D04D9514E6
                                                                                                                                                                                      SHA-512:64C45D755EA64C9731A7D63E6AB5DE6ECAE6D55956B3EC0C0BABEA713C57E31139E4201974E6F2980703EA5B210D94BECDF04A54B647BB816480DB7A1192FDFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.Va$.82$.82$.82...2%.82-..28.82:..2 .82-..2..82-..2k.82..U2%.82..C2;.82$.92z.82-..2..82:..2%.82-..2%.82Rich$.82........................PE..L.....ZQ.................$..........o`.......@....@..................................r....@..................................S.......@..|........................K...D..................................@............@..@............................text....".......$.................. ..`.rdata...%...@...&...(..............@..@.data...(....p...>...N..............@....rsrc...|....@......................@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\10\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):320
                                                                                                                                                                                      Entropy (8bit):5.326804241243158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xMxVLKOSrPjnFXirPZNbUQ5l3nZKARTKRo0Le8MqcsNJs:2VLViRCrbd5VnZK0TKRNSsNy
                                                                                                                                                                                      MD5:54474DB3D028B1527B7259E6427F7DED
                                                                                                                                                                                      SHA1:CCB8D4866FFD17CF518BEF9E18FDD441DFCBD4CC
                                                                                                                                                                                      SHA-256:62A5F86D26164A133C033B8A09EF5137C73FB45A7EC4563EACD4B016C8351230
                                                                                                                                                                                      SHA-512:FDCDE8E131D79EBC4E93F0F8BBD41709ED4C8CF79A8BDCFAB57B9067B7855498E0BE4E3044C0C4BF3BA4CE9A141B00CA5646E06B23EAE1EA760CC8463A7A7E87
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=10..version=1.0.0.1001..name=........*............[AppSetting]..icon=logo.png..smicon=logo.ico..frame=1..title=........*............url=http://static.apc.360.cn/cms/skin_uploadwebapp.html..catch_img=back.png..width=760..height=480..timeout=10..fullscreen=0..rclick=0..max=0..vscroll=0..slideeffect=0..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\10\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9662
                                                                                                                                                                                      Entropy (8bit):6.561898688748442
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:sUcTe6rqKLcgvdeqz+Ql96HAyHX3LpCEqqNjllgPxxXJitQp:LKIgvAsl9IAynzqOLg/ZyQp
                                                                                                                                                                                      MD5:2CD835A7A37080E6407EECE713D94D85
                                                                                                                                                                                      SHA1:0B3C0DD404B8283649E297577A07D061B1E027C2
                                                                                                                                                                                      SHA-256:0573D5F151A829FE8795A1EFBE2B22CB50F70B52E674E628867F6C35578C1890
                                                                                                                                                                                      SHA-512:53DB5DD3CBFB899C3B308C15BD0657E724D60B29533EECFD90704A8D8EA99BAD4A7F9F3FFDE2CAF9F119E3B53C80C5260A96FD214423AE31335B97EC11BCFE41
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%......(...0...`..... ......%.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................a122.0/0./10.132.132.475.<>>.JKK.TWW.]__.dhh.gij.aee.[\].QRR.FIH.;<;.465.344.376.585.698....Z....................................................................................................bcd.^``._`b.]a`.^bc.rss.............................................chf.bec.bgc.efe.ffe....w........................................................................................................................')+.........................................UTU....#....... ... ...'..............................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\10\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1018
                                                                                                                                                                                      Entropy (8bit):7.745716050054846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:GiTESGwxRqlt1m830H8v5DbpT53H/+kkz6iqR0:ZYSGwnqiH8lbpT53H2kNhG
                                                                                                                                                                                      MD5:463682E0470747EA57EC16831288666E
                                                                                                                                                                                      SHA1:E2FD1968489B79A5B63401AAD5D76C7ECE216D61
                                                                                                                                                                                      SHA-256:073286DCD12BAB82FE98695C9BA2C477B1C3D693BBD269D49F1930E1D92F3F34
                                                                                                                                                                                      SHA-512:A849D00B70AA8F8FB89D6E93F3E3AFC68996094EC450AE40DD19C643EBCC657FD14EE40B6548FEBA9F64FACDF43C0C10D36F17918FB1DE9589E9B41F4F6D1969
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.LQmlSe.~......u.vm7........9...H.1.E.Y.....]L4..'...C..?..%.,.".b`a1X...8$..c.]m{...{{.....'99'.9..9.]!?V.h.V)..]....J..x...Nr.6.Z..:...jU..0e.y...=.'.....O(..w.X.s.9.$Q.../.o..J.2l.....~..^\9SB..X......~.m.L...n.r.sD....'q..eX.....v.j...o.O=v...2,..~[..< z.8.9..*..=..!AAS[.....^..;?.....a\.K..<.........,....Ss.QS..2X...,.........8...7m.D..G$hS..%..............j..!.P#..-Bc*...C.M.'....."....;. [...I..s....y!.|.X.@..A..\)".0...W...p..;d..^d.f..5.]D..........g.kz..OO/....c...16..i.e+.r.J.4.+),]..3.....`.f3.~.iC.{'}o...E..A-"rZ.L...VM.{|....SJ.H..N.!...Jr...YY.j.D.....`......\.R"./.'.a3....J..N&h..,...#...........Z..@X..k...B4.AJ:....fE.U5.V.E.7@b.&..ws.7.f7PX....f..^o..m....Y.9##..X.C#.D0..[ g.=.{...NW...a....&7D.EV..s......!..@,.G4~.J&.Px.(N.<..L.........#{..[o.P...<`.w.. ...........B..y?l7|.....,.x...#G...`....8.+.{.y.b..R...P...=..ZW).N....Ee...o.........T.p...$.W...a.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\404.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):581
                                                                                                                                                                                      Entropy (8bit):5.671194366055472
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:h4QW3tL6QcjWR0NNEXW0YWtRIkT4BkQiE4mT/qzRWh0M8pcPUvSsmNTAXaWmkoz9:hPg96QclfoxdGL8pccvSsmZ2bc16+AGb
                                                                                                                                                                                      MD5:F14655D20C6A0F8F7689556EEDC6EC78
                                                                                                                                                                                      SHA1:687EEA25A387F769FF4F276A44932373E0C18D21
                                                                                                                                                                                      SHA-256:4BC05D51F81F548FEE56744D979AEB3782691F3172AFDBD7E9880A8C9AFF0551
                                                                                                                                                                                      SHA-512:D4138FEE06B99C317B50EE13B4E921D17F84D357BA9EC595B352195156D4255E23A39A67D5FD59FBA75DABF59C9B54867522AA21C5CB5D6491AC0D7D0BA91D40
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta name="Keywords" content="......" />..<meta name="Description" content="......" />..<title>......</title>..<link href="style.css" rel="stylesheet" type="text/css">..</head>..<body>..<div class="bg404">...<p>............................</p>...<a href="#" onclick="window.external.wappCheckNet();" class="icon-1">........</a>...<a href="#" onclick="window.external.wappGoCurrentAppPath();" class="icon-2">.......</a>..</div> end bg404-->....</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):268
                                                                                                                                                                                      Entropy (8bit):5.016387560591547
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x/XWVLAcVnT6NbUQ59KKY/JdstJUqW0JOLeRM3uV:JWVLAcN6bd59KKY/JutJQWsuV
                                                                                                                                                                                      MD5:11153E7A49AC28AA0F6A5BC13B4155FF
                                                                                                                                                                                      SHA1:4641F591FD8E31C8B00B231FA79B2700EC7A87CF
                                                                                                                                                                                      SHA-256:3BC6D68B3423D29CB03D5CEC8E4FA2262D4A7DBAFC020A68520B8EA3A0E573BC
                                                                                                                                                                                      SHA-512:14AC8011A89E86FEC6D24AA5DEF28AA616E49E6447C74E428A59D73BD894E7C36EAB9D2D89171E6C663D1536F6631B4431FCEA5791B2E3C7AF802A30893C2F1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=12..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/selected.html..catch_img=back.jpg..width=780..height=508..frame=1..rclick=0..timeout=10..dialog=1..errorpage=404.html....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\bg404.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 779x480, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14335
                                                                                                                                                                                      Entropy (8bit):6.92934378343167
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:7UpzlnERXDNZSzCA8h+uSp5cbSfbHwjzVsZGq/Slh1XOQuytQZ4z:qh0XxZSzCt+v5ISbHov5OQM4z
                                                                                                                                                                                      MD5:FAF8B6385FD7F996E95F05BD1F835895
                                                                                                                                                                                      SHA1:DF57708B207CE7C482ACFE33898DF3CF12344B15
                                                                                                                                                                                      SHA-256:611C3EBA62899A3A033CF9C0E120794E676EE574E161BB9CF35CFD02C47BCF96
                                                                                                                                                                                      SHA-512:064F591A8DC156802867460D34D1B0B4887707227E83E5D693B1209911E18A205BA80DC6994DC876D217CD096935CE8C94790EFF0A068674B1D09186F105A3D9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......F.....)http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5684837B8A2111E1BE88852A1E825E74" xmpMM:DocumentID="xmp.did:5684837C8A2111E1BE88852A1E825E74"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:568483798A2111E1BE88852A1E825E74" stRef:documentID="xmp.did:5684837A8A2111E1BE88852A1E825E74"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\icon1.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 15 x 15, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1427
                                                                                                                                                                                      Entropy (8bit):6.7017778396309815
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:e/1hpunQWwjx82lY2T32HEV/jdryJ3V/gKPcGc/drFnu9I63Wd7FTpt2STg9:eNitNn2VpZmJ3xgMc9dZnu99+pt2STg9
                                                                                                                                                                                      MD5:3F70A66B5656E9B98EAB16B97AF4DCF1
                                                                                                                                                                                      SHA1:FF8371FCE8A94F339A005E50EE56A94DBE6D34F3
                                                                                                                                                                                      SHA-256:F554B18F74C318F1C83E0C83FB7C0EFDE426C96742FF4FCA788030FBDB690D32
                                                                                                                                                                                      SHA-512:0963755D42F563463D182BA4342E632C0AB4F901ABBFF5AFBA528F4B11736CB745432850B2DAED4F649305E6203310ACE3A3B4F270440A3190393D6C80A780E7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............ex....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:85E7192B8A2111E19C57D1488CDA6081" xmpMM:DocumentID="xmp.did:85E7192C8A2111E19C57D1488CDA6081"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85E719298A2111E19C57D1488CDA6081" stRef:documentID="xmp.did:85E7192A8A2111E19C57D1488CDA6081"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8.......PLTE...{{{................................zzz.........|||..................888.....///..................mmm555BB

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\icon2.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 15 x 16, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1341
                                                                                                                                                                                      Entropy (8bit):6.660314282726688
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:D1hpunQWwjx82lY2T32HEVC4paKmFj8yJ3V+ZscKojGhL4zO/mnZ1D6I4Q:JitNn2VPpqFrJ3EZsiju4z+mnPmI4Q
                                                                                                                                                                                      MD5:022049480A6EEA22446A57B2B48D6BC7
                                                                                                                                                                                      SHA1:3385B067F1E663C28F777A96AE5957A7B574E9C5
                                                                                                                                                                                      SHA-256:388A11AF4D1B8EDD9A3B4B0180A7FED9CF02B8F45385FCFFD4051C3D64CA146F
                                                                                                                                                                                      SHA-512:81038C586AC241C120B00301B5DC744AFE90B059BD69600E90F140B3CB32693FEE68F312934262D3FAC3B4537E7B45D9D44520EEA3855DD674F30175AC9602CF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................6....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B4CBF35B8A2111E1BC3FAD68A8934BD7" xmpMM:DocumentID="xmp.did:B4CBF35C8A2111E1BC3FAD68A8934BD7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B4CBF3598A2111E1BC3FAD68A8934BD7" stRef:documentID="xmp.did:B4CBF35A8A2111E1BC3FAD68A8934BD7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....PLTE....................................aaa....................................................|||qqq@@@.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\img\star.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 71 x 30, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1460
                                                                                                                                                                                      Entropy (8bit):6.710870562337673
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Uu1hpunQWwjx82lY2T32HEVL6oyJ3V8qGAHgHUu6BmiPDM1r+5Ckz:U0itNn2VwrJ3HnUt6BnPDe+5dz
                                                                                                                                                                                      MD5:7094A805F02511F487BBB62E46730610
                                                                                                                                                                                      SHA1:AD83885F1146A009925539715C2D944007990CF5
                                                                                                                                                                                      SHA-256:2142EBCE84866039D63B991E0CAE2AE7A4DA7BB7A6696A9AA0C27970204F21E8
                                                                                                                                                                                      SHA-512:A875C83E8FDDE33C1DF7310B4F840995C0FEFE493C4AEE42F462FF34C3A04A53F2134389CAAC2219C3F8FCAAE367F36DAE37D2D7403EC06D5D3CDC20B832A59D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...G.........I.......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D469F9978A0711E1A913CE9E06B5EE48" xmpMM:DocumentID="xmp.did:D469F9988A0711E1A913CE9E06B5EE48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D469F9958A0711E1A913CE9E06B5EE48" stRef:documentID="xmp.did:D469F9968A0711E1A913CE9E06B5EE48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...o....PLTE............xxx...uuu......}}}PPP........MMMzzz.....yt"{{{<3*..ooo..dddFFFJJJ...UUU~n"ttttd ___.....TTT.r

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):4.853209632444685
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:KDnYX6EGZ5XQV9WR6ZYL6GV5Er+QasB6l3Jrl2ABWgAtcYMEycxOwA4Au:KDnSdG0rWRB6GhUBIZRASYMQOlw
                                                                                                                                                                                      MD5:77224A930D612CFA147269F5BBD2B2AE
                                                                                                                                                                                      SHA1:4A199B46F400E43B8D92EB1347421486B7D2582E
                                                                                                                                                                                      SHA-256:818BAE51AFDC6AB53F20962AC7333DE7ACA75B441D0C3D393E03E0B5E1DFF938
                                                                                                                                                                                      SHA-512:C141B1F74C2F38B10A9B759BF21805E2E9AA925781599199F3F558C950EEEEAB1BDC13027524DD3C635044C7A6D005D848D835CF700C9ADBA1FD977721341297
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ........................................................................................................................................................................................................................!...;...K...H...:...)...........................................................................................................?...e...|.......p...Z...D...0... .............................................................k.;.k.i.k. ...................4..._.I2..^8..1.............y...l.6b..J...9i<.................................................k.}....&....u...k..g.K.......&...K......`...r...Q..k?..P6..)9..0U..Fq..\...U....8#.............................................l..W...Y...J...6....z...a...?sz..._%dQ.>...7..%....v...[..nC..ue.#cp.'[...Y...F.a.............................................l..b...l...M...F...C...2....^...=o.:...L..4..,..)..%.......f...S..rQ..hp..Kve.............................................m..b......._...D.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):773
                                                                                                                                                                                      Entropy (8bit):7.695863552306289
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:37MFMYOphpgl8jMKuU7mTOSGvo6Ge8SU3ax:37YMXgDjQD8SLx
                                                                                                                                                                                      MD5:C6D64D2E656C4B4BAB740F9B2E6BA71F
                                                                                                                                                                                      SHA1:03930A6FC25F5509049DEBB5375CFFA29393057C
                                                                                                                                                                                      SHA-256:6F4E916D0D8A96AFCE535FB2C72872CE85D4DAFFA230CFF432E64BD3FD92706E
                                                                                                                                                                                      SHA-512:1523890264AAFA976A9214533B58697B88F807568B690023C32C4835828B28DF85EA397F2A529717C991341A74B89D917C6D89F8CA15E2BD0DEA98B05B493153
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMHTQ......S.F..tt....$EJ.Z$..D.h..p.").........m.Z."p..pQYi......4...y....)$..{..~.........l....J..V>.V........W...a.../..e...sc..S.66...............90w.e.{...o.Lj..r..k%4K.>.oW.!.K.....u..R........&..-f...@.fZ.y.!..+a..`.1XF.|L.l+8i.+..R..$B:.....!..=.._y..=..,/....E.`....#P...Z0....|z..O..E....E .,.:....^0*#...#._...T...*.'.o+.^....wW...PN.2..4 A...d2...l....q\.<.C(..4..\..N}g..{*v.J..=.S...h>..'Z....R...#.....Wml..X'..........^.ee!.d./......rQI..Zg.....J..].K...]&A]Fd..1-...u...:Nz. q.j..T..@.:..}...|....gmm.....6..mc..F...@Q]$.d0?3......U>......o..}...a:..."[Al..V..G.:DX|.|.W..L.y.ISYB./Rl.s...w.r.p.m ..m.i3]...W).1ddH....0.<.&..mV!....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\12\style.css (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2834
                                                                                                                                                                                      Entropy (8bit):5.217757716871249
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:hAyEm4LVV2K+cxaxVvZt67x3aYM+j6AK5:hzETL72+wvZYx37Ms6A0
                                                                                                                                                                                      MD5:DF8ACFDCBAAC70E85A66F54AD5A7CD28
                                                                                                                                                                                      SHA1:48A82D1BAEA5458F328AA5FA91FA130DEC38B86B
                                                                                                                                                                                      SHA-256:DC8C5BBF0CE53259F05D78EED3C7E389C78ED8F35EAE8184F5364824375DACBD
                                                                                                                                                                                      SHA-512:686B80F9D58EBE22CC7C1C6FDAFB1BD7976B9BED194E9D184844DBA3D42A9B94195DB8EBA6D49828A97368F12461637866C2E7734AE10BD82B7313860FDA121C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:/*Reset*/..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0;}..body,button,input,textarea{font:14px/1.5 Tahoma,Helvetica,Arial,'......',sans-serif;}..ol,ul{list-style:none;}..h1,h2,h3,h4,h5,h6{font-size:100%;}..fieldset,img{border:0;vertical-align:top;}..table{border-collapse:collapse;border-spacing:0;}..address,caption,cite,code,dfn,em,th,var{font-weight:normal;font-style:normal;}..a{text-decoration:none;cursor:pointer;color:#fff;outline:none;}..a:hover{text-decoration:none;color:#fff;}..body{color:#fff;background:#2e2e2e;}...wrap,.bg404{ width:780px; height:481px; background:url(img/bg.jpg) no-repeat; margin:0 auto;}../*cover*/...cover{ float:left; width:310px; height:437px; overflow:hidden; margin:27px 0 0 18px; position:relative; display:inline;}...cover p{ padding:0 15px; height:82px; background:url(img/txtbg.png) no-repeat; position:absolute; bottom:0; left:0; _bottom:-1px; _background:#000; _filter:alpha(opacit

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\13\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                      Entropy (8bit):5.042940971137794
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xfmVLzGtZVnLJsNbUQ5TkHJKKY/HXVgXhXW0JOLe/sK:kVLStZVubd5TzKY/6XgWuK
                                                                                                                                                                                      MD5:76BCFEB0BFB8B6BD8CEC28854FC4D42B
                                                                                                                                                                                      SHA1:76AFA2BBA001887D10839624142FECFE61CEAB4D
                                                                                                                                                                                      SHA-256:459231F45A31166C2E5B623A28B6D2AF95385ADFDE2E8B273FABC7BC9DDB442F
                                                                                                                                                                                      SHA-512:60ABB38C8C3319DECD8C1742AD2501584B24479761A4F88FD6454300677B3DB5D601D03D8699F2689B662D1159AAFB5C5D4A6FEC4ADCD384FF7FCEE7C981742B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=102395759..version=1.0.0.1006..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/video/shipinhezi1.html..catch_img=back.jpg..width=920..height=700..frame=1..rclick=0..timeout=10..dialog=1..max=0..vscroll=0..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\13\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):5.282838979968636
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:T4a8bQsPGZYKQ36wejgyzSy+oYV+DMxZC5e1aaK6Ath2BcRy:TX80sP9Yl+/VlDcet6h2Ww
                                                                                                                                                                                      MD5:C01D51842DAEE8580974E01879B235E3
                                                                                                                                                                                      SHA1:70FBF395BE53B5AC089CE4D9EC253F49046EEA12
                                                                                                                                                                                      SHA-256:7B062943DA7C2D5C5E327E280174AF39832FFB9C0DFDA4B54567980CD8E42663
                                                                                                                                                                                      SHA-512:B5CC629A8F96F35DBEDC7A1DFC6AAFF743C739F395F294A1311F19E7C01CCB5EEE557DC5DE2C5C58B518F86479754E8A4A5034A6FEB2DCC69B306F2051454002
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ................................iLLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL....T........LLL.VVV.ZZZ.\\\.___.baa.edd.hgg.kjj.nmm.qpp.tss.vuu.xww.zyy.{zz.|{{.|{{.{zz.yxx.wvv.trr.poo.lkk.hgg.dcc.`__.\[[.VUU.LLL.........LLL.XXX.vvv.xxx.zzz.|{{.~~~.........................................................................~}}.{zz.xww.YXX.LLL.........LLL.XXX.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...O....v...r..=..V...Q...O...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...O

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\13\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):440
                                                                                                                                                                                      Entropy (8bit):7.086005302182458
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72PGibjgYpQXmngdL75VfLfT+bmhPtN:qsv5gR5VfTk4z
                                                                                                                                                                                      MD5:B9092CE8A3E15D256B74F3D613FDC3A3
                                                                                                                                                                                      SHA1:AED3236B71F433E2711401DA6BE0DEB71BCE388A
                                                                                                                                                                                      SHA-256:53690FBF4331D52E27306439966B46A592EFAA673E51A4F230A40C6385F1BCB8
                                                                                                                                                                                      SHA-512:05D1BF69CC149906706298FD4486FAD200451D32D37005FA9437328423FAFC9BE42A520B978250F0D241F900B4E3EDEC1B55456C553513F5C61CF5EF5832876B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b...f...._.2.....DDD.122...I.....A.0.y.FK[[.a...(&.0>..'.........G......M.+....+..G..QQQ '1...0|.......D......U...@.aaa.....u.........w.^......L..l.@.......4>.....Y.........$G!.77.%.,0....(...2L\.......^...L..dbD..2......j2T..E.Q..........7...3L..a...@.#......+....0|....<N....>c.C......n...j..-...2..L...(. #3...>(/P.....xk.f..#.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 800 x 600, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42976
                                                                                                                                                                                      Entropy (8bit):7.976986096657465
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:JY8DOTs0tZu86QOBlrpSYZFOS7TW1jzoouQQObUTQHd9W:JnaI0tY86QOBhpqgyX9uQQO8id9W
                                                                                                                                                                                      MD5:44F6139324A0D5BE1FEFC6AF9CFF9BF3
                                                                                                                                                                                      SHA1:F564C49D243B598B6230F823E894A22C99AC6E30
                                                                                                                                                                                      SHA-256:401FD43380FB9AE94E5E3D0C7C3FA5F663952AE1FFBA9F01EB019922B1EA9794
                                                                                                                                                                                      SHA-512:AA302CA47AD77CCB566A57B19DE784FEFDA0241D36986CEBD19850F170ED7B1B8DEAF18D57ABE9FBBB8F871C5F1EC36C0BC96DA6249A95397E4A893EAA97E82F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR... ...X........'....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Y.%.u&V....nt7z#6B$@6(...H...5.=...F.....c".`{.:.~..!..m.~....$...o.....8#*$....!)......l. ......o...T....Yu.O.V....2O...2.,t...?v....A.P.UPw....{...(.!..j.]...Zd......e..Bgh..]...#V=.Pd<D.y....._..(;Z.(.f....-.M.GJT..U..p{.p.p...%........."..&{'.....6.....B............0...S*h;(8..w..V.c....,..N..]c.......b......Z.E.>@...L.ou..2..T.[W.jg..`a:....A'.....o{.'.P.;...c..=&.k-..zk^... X@#sG.>..F...tK.<]S;.@...ddu..1.. c...z..u..>.o.....5O.......U`.].0dn.7.....$../...f..0k....wB.o.`.,.%4.(.....fE&e..e.i.1.......].....B....N....z...<....+..K.HE+5...D.V...s.7@..i.TW.Y.#.......f......@......In....n.A...w.s..M.Q.~.kx..nr._..b;...V.v..)"_8n....V..h{.p}!.`.F...S.ik.Hn.7_T\.5M4..=.g....N...1..xb.l.W`.....T...[.tX.......tB!W.. X+.g....V.,z/Y..2.aUZ....*..eb.a.t..4._.p.}.V.d.i..+yq......m...ZU+o...._..L......lgm.v........t..L...mh.}......o*o..T.:l3... .(...E..:.?d......B...6..f..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):257
                                                                                                                                                                                      Entropy (8bit):5.037816982032033
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xkouWVLVS1VnTkNNbUQ5WKCW5MKAX8VXW0JOLe8:iodVLVS1JQbd5zMK88UWG
                                                                                                                                                                                      MD5:1AC97EB96E408FCA59220829D5F359DD
                                                                                                                                                                                      SHA1:58839DE61AA3112519C29E69CEE87AD73D53555F
                                                                                                                                                                                      SHA-256:A6A1580CA87A12E35774A2FA67A9DFCD6EDF905E7512C55D591EA10E66DC52DE
                                                                                                                                                                                      SHA-512:D06127BCAB88EF19ED0C686219AF684AC552462661E399815E4E2863A1E74A5F2F3F695967EBA8F1B62409620937347AA7AB92EE67578F6AEF2C74326BB69882
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=102395754..version=1.0.0.1004..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/music/tingyinyue.html..catch_img=back.png..width=800..height=600..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):3.2550150789181798
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:kOsvGVoyywlkyy+PNkFl34XCXBq2kRMbZ1IIIIIIIIIIIID76rNU:kOKGVPPu54XCR8cGU
                                                                                                                                                                                      MD5:77F7A0EC343EB8863C600A7DF658C29A
                                                                                                                                                                                      SHA1:622E65827F7E0B1549811F884D0A5515D63B83F6
                                                                                                                                                                                      SHA-256:B330B7064CD9A60146C6C18048A26E14642B4143E50F8173DFA0BFBB55628509
                                                                                                                                                                                      SHA-512:3B41E06C47329D386C7CC959BD84166D619B16C91D2939615C5C3E43BF26B7DB3759B9DA7E0539DFE5D48FA08C745A62F40A2C19F8370FE1D266A51DA1195F7F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................................................................1.H.}7...@. .M...@..}7..1.H.................................................................................................}8. .N. .N. .N. .N. .N. .N. .N...:......................................P$u..?. .N. .N...?..P$u.............................e.. .O. .O. .O. .O. .O. .O. .O. .O. .O..j0...............................@. .O. .O. .O. .O. .O. .O...@...........................H.#.V.$.\.%.^.$.\.#.V.!.O.!.O.!.O.!.O...J..........................t3.!.O.!.O.!.O.!.O.!.O.!.O.!.O.!.O..l0..................... .R.'.g.).q.*.u.).q.'.g.$.Z.!.P.!.P.!.P.!.P.........................!.R.$.].%._.$.].#.W.!.P.!.P.!.P.!.P...J......................t=.+.z./..1../..+.z.'.h.#.W.!.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\14\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                      Entropy (8bit):7.410199232361714
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72QMpFzl013hVoss5uA8IFvxYU1I6FHrtoGAWh3:kMpFmGsm8IEUC6NtDh3
                                                                                                                                                                                      MD5:9832AD31BB85BB3F6ED4A91F1758C968
                                                                                                                                                                                      SHA1:5A78759E3A544619A60FF123450D7ECEB7ED9A12
                                                                                                                                                                                      SHA-256:F64147F2D5DAE7DFB98776F24C45D4021329B6C264AE7308845C9F5DFC2631A0
                                                                                                                                                                                      SHA-512:500659B62217099F29639D68BA391B51AFA62B216326E5E17BFE7C612AA62C964C2DB4A312507411087E9A16372469965C256BCE5F2D20B093E4AF376E006228
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.S;K.A......`....m..(..ZX....m,m........A.....&.H@%j ..<..s...u.pr&..t.c.....%B..........._.........@.T.Q..X<.]..<f*g(.V...+@%"{e*K...2........n..%f.m(P1...t.`...!............_.4..9.X..G0....h...z..\N.....o...T:h..u.......M....m;h2...mg..+...6.l....8.....U......Ay9U2.....=..."......g.tD:^}eT/...{.1 ..&.}a.{.S`.~TI...!..`_$.SY..].......&.........C.<....^{..;5M.Jf.C.o#..s...&_.[p...?......../W..V....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\Loading.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2012:09:26 14:27:43], progressive, precision 8, 717x671, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):16051
                                                                                                                                                                                      Entropy (8bit):6.383750878137176
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:Vncibwy4Mjk8cirkn6JrYNMtKwrwLZS37ONYxdYmz1f2/TF51:VfH3/An6JrYNg7O4L1xdHix51
                                                                                                                                                                                      MD5:EA53BE66F4F8D34176779A2DECB17306
                                                                                                                                                                                      SHA1:AA20C6B8B45919CA45E9149A2787A46C2F4B1BD3
                                                                                                                                                                                      SHA-256:FA2BA962CB670DA5ECD43312311C21BC493311B923468A214705DFAD4349F1AB
                                                                                                                                                                                      SHA-512:5AB92127797CB510148C10E2B87A104C803806CE7CF7F683B0CD2F1450DDE4120471E8861C3272B701031E1B9961654FEE4B43E1B85F7B99FB00EAFC60D7BD9D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.....`Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2012:09:26 14:27:43...................................................................................&.(.................................*.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.O.B4.Y$.%J..I$...I%)$.IJI$.S....I$...I%)$.IJR.0S

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):310
                                                                                                                                                                                      Entropy (8bit):5.107261797814054
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x82RcVLwSSVnGSDNNbUQ5joLD/MKpjJJLkn5LwvNzALwvW0LWERSyBStp:u2cVLwSSsSzbd5ULDEKp1Jk5UAbCSp
                                                                                                                                                                                      MD5:792BE06C777E7289AA7743B3578EDFD8
                                                                                                                                                                                      SHA1:102EB6C07CA71042345FC0E887F0DE1E59F293CE
                                                                                                                                                                                      SHA-256:012199A9362834D304C490A4B87D306064994B45ED569DC904FA9719E96CDA57
                                                                                                                                                                                      SHA-512:60A0E7538168CD5243CB16ADFB11D84949B3621C27D91F6548EB0E34A77C66A4DD5149521FE52201295BEACE09954D72526279D033508A34EF2509DE6FCB3CFE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=40000094..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/theme/index.html..catch_img=Loading.jpg..width=717..height=671..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..hide_share=1..dialog=1..NewWindowInIE=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5430
                                                                                                                                                                                      Entropy (8bit):5.1820953247333605
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:MHUxOezcKDm7oTao7H5I/prMC+B9jmvn0SLBl+Qg4:qHkcKDP5kpot/jS0Us4
                                                                                                                                                                                      MD5:447FEEE2F8BDA18A8FF699841D0B73D5
                                                                                                                                                                                      SHA1:385C69F412FCC9F3A6979D4B0BC786C51B1C15C9
                                                                                                                                                                                      SHA-256:9A0BBAB5E672AC9365F56BDF5C0FA4FAF69DCF80D08F0A7C8B622A72FA7540A2
                                                                                                                                                                                      SHA-512:F4D6261CF727DEFF62D861053C6C8AA0D17283A0224D86859A325FDEDE36E3C1182FC4BC0B6504CBCD6027DE370A66EB156D4F2756E53D68D60C0BBE134A7C28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:............ .h...&... .... .........(....... ..... ......................................................................................................{..XGV.R@O.N<L.L=K.^Ai.b=~.Y7..M5t.E6^.........................s=o.C0B.Q9P..\...l...N...;..h1..W1..E3...........................i.........|...e...K...=..~3..U1..SC...........................o..^..a..r...W...L...;...*...3..l^..............................X..E..?..h..\...:...+...'...y.............................k.N...D..C...F..A..kl..,...&.............................s..m....M...@...F..D..<..nE..)........~...P........j..................y....N..F..@...0..c=..(...#... .....8....M.3..............................N..8..r&..OP...........~...W..S.c.".8.[.....*...8...A...>...M......._....q:..6r..&....~......}..Z.n./.d.,.Y...U...a...b...I...i...w....~E..R..R.....8...........-....O...Q.f.g.Q]j.Jk..Jl............{...............................u{...4F=.p.z.....QaY.V.........:......................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000094\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3577
                                                                                                                                                                                      Entropy (8bit):7.896644078371665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xYEIm73V60+:bSHIIHUCD4waL73V/+
                                                                                                                                                                                      MD5:B12E3D6ACEBED86F40DFB4C894D24138
                                                                                                                                                                                      SHA1:2768BCCD2F8ECF62BCD166CDEA53D5105B927C63
                                                                                                                                                                                      SHA-256:72BD130D287CA9BC222BF22006CA9C7776838A664A3B8EAD5B061A6461F5C06A
                                                                                                                                                                                      SHA-512:43506981ECB1ED3C3AD2C280777079E93EB7719F8A4A74688E2FCCB171850B9F2C31E218644E6C43A59A1A70C2F47B3490ED0EA0635D35975A6EFB9101AFCCBE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\back.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000096\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):622
                                                                                                                                                                                      Entropy (8bit):7.566184431026209
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72r1s52jrOZBaFZgFnx5fCBOkOKtlZcT14kdqwJ7eNKyWZvsYSXmOT:31fuZMFZsx0BL3cqsnyWZvs/7T
                                                                                                                                                                                      MD5:56AEE1C86D6256F465815579E5AD516D
                                                                                                                                                                                      SHA1:6CF2FF2084E5695440F4C73A027545C2DE2CB533
                                                                                                                                                                                      SHA-256:45AB4386467F1C6C692138C7352767F45AB341BA985CE0BAE3B685F0350E53AF
                                                                                                                                                                                      SHA-512:BD304991D7EBAD9181ACD2C84FB32618E7BE35A69F1CF94289D2257F191917B6F43C9E68754E9D2102F31E86D380FDF4E58B29046EE543941F7BBEFAE35B7EE3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[o.0......nTm..RW.(H..T.....<...PT.^..V....ffr.E.,9J....7...r..@.?.s..s..hMS./#7....W<.na.F.F.....U.0...D....A...j.i.......dWk-..rl.~ .$..1]E'.&...']...z..x;?......Il..m..0.......e.-89ONLHpv<...}C...b!,,....i.8....f.....~......B..+zHy..o....#...x.X...y.....).'"....j....=.....N.~.<R...A...O..4T.(..F..Z.G.._s,.V.C........;......6...0e..9fG.l...F....F....w.....ShX.C*.....W.s...=/PQ..Kk.4Mq:5.ay... .6c..m..S.E*".M..`.!..^.O....= Nf..>..?'...{....8.....I..,H...r..$.......:...r.+.....eg...C.L..\.K....J6........IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):258
                                                                                                                                                                                      Entropy (8bit):4.932198833574818
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x82xVLBHVnza/MKpjUeTVetLKwvNzALwvW0LWgvJv:u6VLdYEKpYeTstLLAbW
                                                                                                                                                                                      MD5:CACD252CC23EC905A63DD8DC315219DE
                                                                                                                                                                                      SHA1:34550B2838A26B8EA7301A5D1BDBEB9A16EC2782
                                                                                                                                                                                      SHA-256:2FBAB88911F57D850191D2D76D612B41FFF7233026BB2AB96FC9A1AC0177A66D
                                                                                                                                                                                      SHA-512:12F309EC5333628583516DCF0F57C871A3DB8175F7C4F84A23488060B776BD75BBB6E6E6AC4D8516106BDA02F013A046474B38F7C6A9FD6CAF352771B39D60F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=40000097..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=index.html..catch_img=Loading.png..width=360..height=207..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..dialog=1..checkurl=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\index.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                      Entropy (8bit):5.4660632914667096
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPO9kQDbu7SGOL8orwtzzrdgCN0/oa3GCK6TqSByA+iY/PQEfjxvnfjL07THT8:hP8Z2jOwJtzP7ittHTdeiY/hfjNfjET8
                                                                                                                                                                                      MD5:D94F9DFD6BE72C13357CD4312E29CF2A
                                                                                                                                                                                      SHA1:E72A49B866693FF8F779161149D61424EDFFA85A
                                                                                                                                                                                      SHA-256:2FF30F56322FA11D365FF77998E7B3982E5869BCB7B01254828C8814DDBECA55
                                                                                                                                                                                      SHA-512:D4D76B4A49CCB21AFAE413FE07214F7CA2CAFCFB9929A27FF5E0260C14E80FE08C31FE6150B57D5FFAEA5C62461AAFA7B48B90FD0CAFBCD05385446F861BEC2A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html dir="ltr" lang="zh-CN">..<head>..<meta charset="UTF-8" />..<title>....</title>..<link rel="stylesheet" href="http://s0.qhimg.com/st.360.cn/;bk_up;style/7e995a0e.css" />..<meta name="description" content="" />..</head>..<body>..<div id="doc">...<div id="bd">....<table width="100%">.....<tr>......<td height="107"><p>"<script>document.write(external.wappGetSystemInfo("updatetitle"));</script>" ..............</p></td>.....</tr>....</table>...</div>...<div id="ft">....<div class="progress">.....<div class="val" style="width:60%;"></div>....</div>....<div class="btns">.....<ul class="clearfix">......<li class="s0"><a href="#" onclick="window.external.wappAppUpdate(1)"></a></li>......<li class="s1"><a href="#" onclick="window.external.wappAppUpdate(2)"></a></li>.....</ul>....</div>...</div>..</div>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000097\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):850
                                                                                                                                                                                      Entropy (8bit):7.609811882129263
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:n0gD0BgZzVm/Wuf/c7CqKYPpVZ5jewEAQ26Nozw9:nfm/kChuHn16qk9
                                                                                                                                                                                      MD5:0F4BA1A40C2EA13A402470EB81C8C59D
                                                                                                                                                                                      SHA1:CCCE59BC5713AE2859611EFD1D030059CA09F3F8
                                                                                                                                                                                      SHA-256:B1307EA4979EB106609D48A429641E9AD125BA8B7F8DCF2E46815DF3F83E2364
                                                                                                                                                                                      SHA-512:0EF7CD9B7CEDFF638BD02BFB07FD7AF133D23E32CDD42693FCE5968AAA23C81D35BD0B46949DA562B166D3C152F5E8E4117326785CDD7C851E5D9A84A787866B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tIME.....+.Q.?.....tEXtSoftware.GLDPNG ver 3.4q.......tpNGGLD3....J.).....gAMA......a.....IDATx...{HSq....cZ...X..cj.....V.. ..P.J.%0....J.L.a.D..f(..9..AR..)...;.,.nS.......\~...Kd?W..~6u".`.hn.(..p$.......T.Dw.....#.A...}.'C|.E{..01..4..*P..95s....x..\..?....$I9.<.~.7.C.&....kb3.1.........~.....C...|(.]i;..:...k.5.$..k$!.q@...0o-.....O...Y..{=.,.rj.../-.g...m.T<@t...*8...3....gx=.1-.k..5.zP..+RGQ...B....x..p..p#.!...@.jcM_`..vn.*..$...@........e...C.{..._.`~.K.7L.@tW(.....m.....E.,.....T.....@.g.c...&.A..Cl..R.-.T.<....X...-y...C....i....".'.......:2.W.<.;f`.%..._.?M.`......a.....ks.:7@.f..6.X.K.0...30..c..&L....J1.z..6....0.].J...n..H..x<...c....4...$.5g....y".p..:.....Y.......+..X.n.Zg+L...P..R....0*.&.q..;`..._....d...Z.:9...%X,....6...?.Lo....\N..3M.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\back.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):620
                                                                                                                                                                                      Entropy (8bit):3.72647716480673
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYu/LwDeGti8PTpKAAtpKD9v4Avr+HKvmQSHQB5HlblYZl6Ya8DoDvZhSaK:Q+JvYu/LGeGZdKAAbKD9vNqKvmm5jYe4
                                                                                                                                                                                      MD5:5E8605184EA5C11692EA7C7BADCC9605
                                                                                                                                                                                      SHA1:97C4A0F2E615896AEC01A8B639FFF7D19D3E2E4C
                                                                                                                                                                                      SHA-256:0B50ABD35242ED5AC75BAF159BBF4E3273BFA9B8F9B33E5DDD0CDC13DFB119A2
                                                                                                                                                                                      SHA-512:A979EA89016B61E31787C476FA1C9998CAE4E87BD6976371666145DF822A75EC11E8AB42C15CC39BE772280D6FBB4C7B525E8543A75F68E984C3F1D5395171C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.8.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.3.6.0..[hQLhb..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=..N.e.f.^..R....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.6.3.0.....h.e.i.g.h.t.=.4.8.6.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):6.631924571015197
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:jSnZcun+bvWCQ0NSxZdWoGtvH7/lF9PjZgBr3DPmRkLT4z:uZX+bk9WoUflNEr3zmRu+
                                                                                                                                                                                      MD5:2A5907C09D75152D099621F1D40D7A04
                                                                                                                                                                                      SHA1:779D93041CD0DBED5DEA3E4B4D315081FEAF586F
                                                                                                                                                                                      SHA-256:ED874B0C638C1B4517A5E9EE21EFDD75DDD0F33CD6B2458F49C42333237778F8
                                                                                                                                                                                      SHA-512:017B60B926D0B6AFB85C18EE2EDE125064754BFFB4E8A4A0460FEF88913DE3FD78F40E80CFDAC993F1AF8A945E8C35A71BFB426862E94BB278BC9D437AF87769
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6......... .h....%.. .... .....F*..(...0...`..... ......%................................F0..F...H..I..L..N..N..R..T..U..X..Z..\.._..a..c..e..g..h..h..g..g..g..h..f..e..c..b.._..\..Z..V..T..S..P..N..L..I..H..G..F...F0......................Eg..F..I...K...K...L...M...M...O...P...R...U...W...Y...Z...\...]...`...b...a...a...b...b...b...`...`..._...]...\...Y...W...V...S...Q...P...N...M...L...J...J...I...I...G..Gh..............Gh..G...J...L...L...M...M...O...O...P...Q...Q...T...V...W...X...Y...Z...\...\...]...^...^...^...^...\...\...[...Z...Y...X...V...U...T...R...Q...P...N...N...N...M...M...L...K...J...Hh......H-..H..K...L...N...N...O...P...Q...R...T...T...U...V...W...X...Y...Y...Z...Z...Y...W...Y...Y...X...X...X...W...Y...Z...Y...Y...W...V...V...U...U...T...S...Q...P...P...O...N...M...M...J..J...I...K...N...P...P...Q...T...U..!V..!W.. W.."Z.."Z.."Z..#\.."[..!\..![...Y.. Z..$e..'i..(g..)k..)k..)k..&l..%i..!`...Y.. Z..![.."[.."Z..#

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\40000098\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1791
                                                                                                                                                                                      Entropy (8bit):7.282304314952082
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:QWHNn2qJXfIJ3JVJUkijyl8B5/UTvLoV5Gm:lt2GPsVJUk7M/vGm
                                                                                                                                                                                      MD5:0C20581BF63BBD796E3D0B4B21BA9C76
                                                                                                                                                                                      SHA1:8AE895DEE318A5F13D0647C289DD92DAB97010DE
                                                                                                                                                                                      SHA-256:7782439597273E15F56453C0E20AA444F94E10845EECA9F5185ACDD5E03CCD22
                                                                                                                                                                                      SHA-512:FC5D085F45B9D028614CB072C9C0D8AF6D7F25881CA79699927604F2CA7FB701AF9A671797EEE63115302B53D47014BF393BB127A79239162A8F607EC0D99C8C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7877C08B225511E2811BAB4F0B0366DE" xmpMM:DocumentID="xmp.did:7877C08C225511E2811BAB4F0B0366DE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7877C089225511E2811BAB4F0B0366DE" stRef:documentID="xmp.did:7877C08A225511E2811BAB4F0B0366DE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.`X....}IDATx...Kh\U.....{g.Lf:yL..6.I5.....E"]....T.W.V.A.Eu..#X\....Bh.h.VP...6)I.XC.4...$.d.7s..}zz.p.8....O.l03.h.JuD#Z.(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41000017\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):263
                                                                                                                                                                                      Entropy (8bit):5.059450475202175
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xrmVLl9ySVnFyDNNbUQ5/UyRZRMKY/JXmBgRXW0JOLe8:1mVLl0Sezbd5syRZ+KY/JXmVWG
                                                                                                                                                                                      MD5:7F9B5752950F1B4FBE18F1D413078179
                                                                                                                                                                                      SHA1:E2ADF90F718E886C0C46B0DADA852351E494D82B
                                                                                                                                                                                      SHA-256:29A569803B2DFC63B96D0177E4824BFDED2EA9B176E779D47C3ECACAE35323F8
                                                                                                                                                                                      SHA-512:A3E7F55CB9544F2CFB86F68402FDFDB10A2BDBEB323ABD1DE83E7D2B5FAC12380CD5B276FFF6A2E66FC131D7F811EA01B42E0141643DCC5A0B027DBD0DA22684
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41000017..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/ertong/ertongleyuan.html..catch_img=back.jpg..width=724..height=512..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41000017\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):5.272865555733899
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:YiWvOO6OOOOOOVdMHgggggeIK333P33333333wHHHH8HHHHHHHHB+cDXfchshfcS:vcOO6OOOOOOLMHgggggeIK333P33333P
                                                                                                                                                                                      MD5:FA4C0871F09256E78A8572E0465BC1ED
                                                                                                                                                                                      SHA1:FC79A4B2F9CDD30F34859B8008E9C00AC25BC7B2
                                                                                                                                                                                      SHA-256:34C607A83BB9E1A3B152DB6C8ABDF5B6495032FC18B6EFF35EE1C435CE756591
                                                                                                                                                                                      SHA-512:EAF558A1CDA73C57A3E546BEA105A08B4ED7D7B035DF8C2A089023973C0338B2B49E4B722C0B7FE93A42954F93220E59C754858956282724ADEEC1576153056D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................y .l..j..j..j..j..l..n..r..v...y...z...z...z...z..v..r..p..m..j..j..j..j..i...r..iC..........................C..A..B..B..B..B..B..D..F..M..O..N..N..N..N..N..H..E..B..B..B..B..B..B..;...\.........................[...W...X...X...X...X...X...X...X..._...\...X...X...X...[...c...X...X...X...X...X...X...X...X...X...z...........................>...'...)...)...)...(...(...(...(...........}...M...z...........(...(...(...(...(...(...(...(...(...f...........................F.../...0...1...1...1...1...1...1....@.....b.....d..z...&.1...1...1...1...1...1...1...1...1...l...........................C.......1...0...1.../.../.../.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41000017\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):616
                                                                                                                                                                                      Entropy (8bit):7.530477633466423
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72rokRmxkKU4RWmbiGIL9HXQFqsPxMRQhK9aebj8idjW:3okMkgqv2m/bhjW
                                                                                                                                                                                      MD5:5CED58E294927112F3AFCAB5B3F65B84
                                                                                                                                                                                      SHA1:EE8C0D989018997F7E7E8A3C8275A2C65DC9CF70
                                                                                                                                                                                      SHA-256:E92FCB0FF36E4B879719DC86C041A0976C8233214CAA87A3C9523580D6F163FE
                                                                                                                                                                                      SHA-512:76BE2FAC5893C5F04F70032CA7C82EBCD7207291D34D68243FCE752D9039587F97E27D16BF7E43C9DBD9384EED18BEDD514D054FA85077F06D10152BA076DAE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMLSA......`.6.*.#....HB=..I9....r..s....$..../..C..W!.J.R.1........U1...By..;.{.%..F;.dfgg..fv.....C..~......._...S...4R.3..s.Z`.._p..p.b=k~...j..v3.2.|.}5.q .W1...3......,..as..........=k....^...e....&+i.A..i..".k..4Q&......~...5.....2Pu..#*{....D..Q$...*...e..U..l......;...P8H..T..2 ..a.X.#....d`...bL.I.Sr=.I(,.....(e......Z...pAn4v.V.....;.U......4..N#.e+.....)x.g......].8I.X..-c....Od4......k.....V.#. T.B0..H.)B.@*...umO:...v}.....f...p...........a).FU...\...ln....U..P>|<H.+y..o...y..}...K....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):317
                                                                                                                                                                                      Entropy (8bit):4.935266667855842
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xEVVLhraVngYtrpNbUQ5nrD0oMKAX8VXzALysqcs57Jwyn:4VLhW+03bd5mK88FA7srt
                                                                                                                                                                                      MD5:FB13058ECC9F1005547A1C11DF46628A
                                                                                                                                                                                      SHA1:68B173CE3001210495879BB466DF942100C638F3
                                                                                                                                                                                      SHA-256:0EE7BA429BC05BAE10A5B86410215361A9A191939DDD8094E85B2CE6D72A88B8
                                                                                                                                                                                      SHA-512:23AEBF934F36FF1A3297FBE4D306F2C35FC1E6CA4884142E5B8E37A5801B0750A79FE8B9E01992FF5FAE19A6390E170595F12A194D669372824B6E4D448485BB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010001..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/social.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.1467555087668435
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/aKppe79frIPm+ZqhcTxFFFhp05qnU684m1eyPxakpDJnyC:icqfrICcT7U684msKakjH
                                                                                                                                                                                      MD5:A4934622B853F2D0558B8810E0C24446
                                                                                                                                                                                      SHA1:42662FC3F946988969854932471C79381C5E57AD
                                                                                                                                                                                      SHA-256:B993933B9225C5476FA687F8F4A1D08465F3D198C36B761B10B76F58CE0E4FAD
                                                                                                                                                                                      SHA-512:C5D1724DDEA8BE0882DD55B0E1FA61EE8DFE10A65CB838D2888156F9DAE6F2DDF7D6C58A6A3B4C0C337D86B1E7A9CE1483C32FEE6F7EDAC9D34554C431166C0A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................be^5hn_\io`Xio`Yjq`Xkr`XGo`XCoaX.haY.haY.iaX.jaY.kaY.laY.laY.j`Y.iaY.n`Y.e`Y.W`X.]`X.X`X.I_X.X`X.l`Y.L_X.:^..........................:...:...;...8...9..'@..+F..5N..;T..@Z..B_..Ca..Cb..Cb..B_..@\..:R..6M..2H..0C..*9..'7..)6..(0..&4...........................3..0M..0M..,H..!5...0...2..#9..(<..+A..&A..$@...J...H..-H..'C...;..&>..%9..$6...0..."...-..)C..*C..,F...!...................... 4..0M..-K..9N....y.w|..x.........S.....hq..fm........M...z.go..T[........K...{.ou..Zb....v.LM..#B..)@...!......................$9..1M..-L..5K.............................................................................WW.. =..'@...&.....................(%<..0L...M..-D.............................................................................."4(.(C..-H.........................2&=../L..-L..=R..............................................................................!5'.*F..*D...0.....................=(@..0L..$?..4>...............

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010001\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1719
                                                                                                                                                                                      Entropy (8bit):7.252548529152065
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEV88yJ3V1aMbgSG1bVahoNN282Vn5ZrMq1lzkaBUgvy5:JwqNn2SqJ37iScbVz282rycFCMjM
                                                                                                                                                                                      MD5:D3243F717AE59CF6FD7FB321481427F1
                                                                                                                                                                                      SHA1:5E78AF0327B7E2DCF4B863C1C149B04ECD0E8537
                                                                                                                                                                                      SHA-256:8AF0DF0967C780179FC269B318EF7DF3CFF75ACC2D8AF05CD55F43E4D902B49A
                                                                                                                                                                                      SHA-512:A737EAC13EE0E43F9F42E522148F5EE5E45A8BFD35DAF18E531A9D521B1A217FF392E7D3EF6A8B5D0713CA6D2433B94BAA802485D4E041000350ED8C0ED2E2A1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DD2CEA94FE5211E1B530976CD51ECF8E" xmpMM:DocumentID="xmp.did:DD2CEA95FE5211E1B530976CD51ECF8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD2CEA92FE5211E1B530976CD51ECF8E" stRef:documentID="xmp.did:DD2CEA93FE5211E1B530976CD51ECF8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>rS.....+IDATx.4S.o.D..f..]{7q...I.P(=...*@... .;*.#.O.....Q/9!q.!q..Is U....I..........b......7.1=..I`}...k ....n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.950785833444288
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x4xVLH9VnJLKNbUQ5nnGKAX8VXzALysqcs57Jwyn:mVLH9zLKbd5nGK88FA7srt
                                                                                                                                                                                      MD5:197E49C70C1EBF512A341E66AE824536
                                                                                                                                                                                      SHA1:7593D5F3EE7375DA9B0CE7755569AC6DEBEBA7B6
                                                                                                                                                                                      SHA-256:C27090AF8896DCDF6B3C59EBC486629426DD9532C00558B6081540FBA6856C20
                                                                                                                                                                                      SHA-512:E9349BF6572CC3C7FBD13C17EA08FAA922517C1B030150F8065507A8CC1F1B7583DB0E405FBEF80955F92BCA3323D516820D7BB39FD9D2C32FB2A2E1B45C4CAA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010003..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/music.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.383412945466849
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:NPQjaRVJsbeyPJdA5eB6R4qkb3W0KgoIf34wvpkJs2kn:NoG1sbeyPJSeBVqS3W0KOf34wvpkJsF
                                                                                                                                                                                      MD5:FC5B6A6E3EF44C5D19DC10876796EDB8
                                                                                                                                                                                      SHA1:5139116462D20F03248FFB07202D86DDC10E66D5
                                                                                                                                                                                      SHA-256:5ECFD31E8DF7784BFE3ED70AAE1E7F6D0AAF08A1E322FF20D07D34B5442A511A
                                                                                                                                                                                      SHA-512:65433A7C12B63B349B13460C2751D3A5D31266D1B1087D5DF188BE5E01276FB887C6E189EC1D5A3D82A20BA073D42C3738916DEF288853165256DF15F7240A73
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..................................?{.f..g...g...g...g...g...g...g...g...h...i...i...i...i...i...i...i...h...g...g...g...g...g...g...g...d...r...*.........z!..]...g...g...g...g...g...g...h...i...j...k...l...m...m...m...m...m...l...k...j...h...g...g...g...g...g...g...c...]...+.:a.b...h...g...g...g...g...h...i...k...m...n...o...p...q...q...q...q...q...p...o...n...l...j...h...h...g...g...g...g...d...r...a..g...g...g...g...g...h...i...j...i...k...o...s...u...v...v...v...v...v...u...s...r...p...n...l...j...h...g...g...g...g...d..g...g...g...g...g...h...i...h...b...Y...Z...f...q...x...{...|...|...|...{...z...x...v...s...q...o...m...j...h...g...g...g...g...g...g...g...g...h...j...k...c...Q...V...W...Q...d...y......................}...{...x...u...s...p...m...j...h...g...g...g...g...g...g...h...j...n...m...`...t............l...s.....................~...}...{...z...v...s...p...m...j...h...g...g...g...g...g...i...l...p...l....0...........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010003\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):770
                                                                                                                                                                                      Entropy (8bit):7.667667994524824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:3aJ6Olfe4ojDeEwAZGoOXXJgwPEPvd6MYnE7:3glfe4ojDAAZ5g3MPlsE7
                                                                                                                                                                                      MD5:8E73320DEA64E756C67D9C2469C3DDE9
                                                                                                                                                                                      SHA1:D03EA57695890D7F4C735790AAACB7BDB41FBE76
                                                                                                                                                                                      SHA-256:BB19792B94FBA34825A7C87B097A6FC1A215F13F6BA03A5C99011DC3BD523C09
                                                                                                                                                                                      SHA-512:C47C93F47898E155EB91070325EB3212A8F05DC298DEA340B9124FABC4DC266BBAF88CB519C9C5E6A274423B05E5DD1205DB1320302937CA5AFC0E5FB5BF5931
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.dS?k.A.}3;{..\L..".Q..........`....".[....@l. .4. i4ELa.1...g0w{......^.p.....y......=....Nf.GR.8.....;.s0.k7/.|(...-.....7Q.........2...DU.Uq..S.RBF.CB.~...d.....3.".T.....`r.G...r.,..[02aL.y.......Ou..#+...w4...E...13Z.....6S<_."...Db...9.U..8.df.pv(.....4...s.htn...8.,b...]... C..p..k..+05R..:.zx....N..i"A.+7h.5Z...'A..t.....$...!.?.pD.SB.:.0..."..{r.PA..t^../.....'9P...`..1..-..r...S.E.AN.3.G..O.0w..m.c.cO...rX$......(..>..9..=U.v+g.RB.M.e...$g..@...........n..P..6..q.o..Q.6.EL.D.cz..9h...lA.V...~p...V...f.$.CQz.....GK...[.~Dm...p.........!.>.#p....T..../..h.V.].$.iV..P.,.;..........cC......$.EO..y R..4;..Z.%Rl..|.G........Dh....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.956344065029536
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xFWWVL/3Vn2NbUQ5nx5D+KAX8VXzALysqcs57Jwyn:3WWVL/3kbd5xwK88FA7srt
                                                                                                                                                                                      MD5:877D7A2229337FC4B8F1BD42D959C2E2
                                                                                                                                                                                      SHA1:962552190B139A59859B20BBF889676810203B90
                                                                                                                                                                                      SHA-256:6F5D4CD8817A6B1A1E3FDCDBD3D4AB8F3A6B0137673F0DD839D3B7B3C9D0420D
                                                                                                                                                                                      SHA-512:135DCC9DB8B2F1ABCCC8D6D9BFEFA1607A1D8AF8B64ED404C65F91E29200875A1D3BBADA647BA4C81FE0300BE364CB4DE5EDAC0B7859DFC3FA83291F9171A3B0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010004..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/video.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.525345605079403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:oPgMlyfRfa3dPrS4msSfiVb1XASV2JVQTpX7y2NMCkD16AhEw+:TftatzS4mWZ1ASVIYpryQMCm+
                                                                                                                                                                                      MD5:EE102FF1CC30D49E1EE94C957716A2F7
                                                                                                                                                                                      SHA1:588455F5CAC8C600F9C109A8A9D36B04F12380A3
                                                                                                                                                                                      SHA-256:D40F7483D0C9F5E99BBBA486788FD26F2CE850B4F4F0105B1C0340FB709FEFBC
                                                                                                                                                                                      SHA-512:D0150E41BDDD0154A0B275337470AD0C61F0E54B915B733F40DE7E0D7EEBD7AC435D0C787B7EB6D4BC1B7658DB6F5B546D4DC59E8BC0DE72328F18F12ACBFD82
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ....................................#...1...0...0...0...0...1...0...0.../.......-.../..20..,0..,0..+0..#/..%0.."/...5...f...o...9...-.......0......................B..(Z.."T..$X..%[..'b..(j..+n..+t../z../.../...5...1...0...3~../|..1x..-r..*l..-i..+b..*`..)`..%[..$Z..&^....................#.*c..(k..(j..,n..+q..,u..*y..*}..(...,.../...)...-.../...0.../...-...+...+...,|..-y...x..,u..-r..*p..$k..(r...C..................%]..&c..,h../k..0l..1o..0r..-s..1x..;..$>}.!>...2.......2...3...1...0z../w../t../r../p..0n..1n../m..'h..$l...H................@.)b..*e..+f..)e..%d..%d..#c..#e..,s..+j...K..(c. 9|..3...%r..'s..*s..)m..*n..(k..(i..&g..'d..(g..+k..(i..'k...N................L.(c..*g..+h.."a...\...\...Z...[..!f..#`...D...H...P..,h..2p..$g...d...c..._...a..._...^..._...a..&g..'j..'l...N................Y.'d..+j..+g.."b..._...^...]...^..#d..#\...A...I...M...H...N..-b..1m...`..._...b...`...a..!c.."f..&k..(i..'m...V................b..i..,i..,i..#e...d...c...`...`..&

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010004\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3610
                                                                                                                                                                                      Entropy (8bit):7.899292397711389
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/x6CuF4wgXk5Ic:bSHIIHUCD4waneSX4
                                                                                                                                                                                      MD5:E78F57089427AA783749018543B1DA19
                                                                                                                                                                                      SHA1:84C16B13CFE2F9B5F7ECA7BF3AD60CBC2C2BC1B6
                                                                                                                                                                                      SHA-256:2287C37DFBDF981D6D24CF8E7B36D4AE3804D57629F28259B4F4987B4AE178BC
                                                                                                                                                                                      SHA-512:DC11BDA55793E119B4A3E44D34B62C8805D929ED4B3155557AEFD97713F1738D1D44012B08FABA842498FAA4B697E79722EA97180BF6429A43D860061F39BB52
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                      Entropy (8bit):4.9604710228149305
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x+VLqVnwX6NbUQ5n+MKAX8VXzALysqcs57Jwyn:MVLqnbd5+MK88FA7srt
                                                                                                                                                                                      MD5:2808B6DD4F7D159D33D74AE710CE861D
                                                                                                                                                                                      SHA1:B307A1327BE1420E183E1DEBAC4458F1885FCDA6
                                                                                                                                                                                      SHA-256:88875896DDEEB7CFA205D20E29E9CB0B05EFE3848C9F8621DF3AB2335077A48A
                                                                                                                                                                                      SHA-512:DE5DF30B2547F719403185531638A906C0EFAFB5B578BB3915412A7DCDF39715DE71E56BD3B036CEC6117178D489B1F9D2FF98B2E6643E1839B3177D74A0E6FE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010005..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/game.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.7310533928540135
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:Ig/FymEUfarNgg9pL91r8HlJjzE0137O0SIVTyr0KmTzo3VSTI0h:htxZOR8vI0d7O0Sw40NPTH
                                                                                                                                                                                      MD5:3026ADAD9B11A1B6351FA78E74DDF068
                                                                                                                                                                                      SHA1:FDCDF989FE0B230FD19A2E677E9AEBC971FE1F2E
                                                                                                                                                                                      SHA-256:1EEBAA6B02555CDC06EA3AA1A7F1E88D19B660F33FB9EFBD2B06941D526541E8
                                                                                                                                                                                      SHA-512:4F93AFC8D1B6826B1A74B3226773A142BB149F7873310F551B4C4D9DD357FACB20295AA763CEE62B8E4D6AB179DC5DBD856FC2A87C79EE31EE963D4D66D30058
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................Kl..Mv..Ai..Ju..)Xs..[~.!i..#j..#i..$k..(k..&i..%g..'i..'j..'h..&j..&k..%l..$k..#j.."j...b..,]{.Sx..Ho..U|..Gh..#%)*........!8E:r...w...}...i...K...d...................................................................h...\...t...........j...2GUM........'=KFz...x...}...q...J...c...................................................................Z...K...y...........}....5GW........(?OR............x...N...d...}...{...{...|...............................................|..._...O...~................2Ce........&=Kb............z...A{..?w..S...W...X...X...W...W...Z...[...]...\...]...]...[...[..._...^...L...F...}...............0FWu........,CSq............x...I...P...]...\...[...Z...Z...Z...Y...Z...[...Z...Y...Z...Y...Z...Y...Y...J...D...{...............9Tf.........5Rd.............u...R...w...................................................................e...N...x...............Ef{.........;Zn.w...........t...F..._...v...{...~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010005\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1013
                                                                                                                                                                                      Entropy (8bit):7.737474544663215
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:7VnREjP+laJQEMkbGCbcZtIQ9D/Q0AMfak6:7VnREjPOLkb3batIQV4VGak6
                                                                                                                                                                                      MD5:6C28A3D7F88C672AA3C3DDF1C71AB537
                                                                                                                                                                                      SHA1:0B556894375739F5C9767D1E10DDD80FF25346DC
                                                                                                                                                                                      SHA-256:B0B0FDD805CDD8C3A3A6167C6D3A328B5A8BCF08E75AA4B623B0D234E9A194E5
                                                                                                                                                                                      SHA-512:597BA016011013A5F0CA26EBB25986DD1F023E946934871F92E109EEAEB8A42A51E11DB5483DE9EAB2B099A381F5A4D784274DFAAD0911B1A01CF346AEC212AC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.$..o.e.....$~&vb.q..p...Vm.B.. TT.Y..JT."....e.....,Z.BH,..]d.J..BE.8Q.fLL....{f.......s..!nqp..../p..-H.Wq}}...{/...g...?8V...G.P.......!|.h.a.}...@$y....).Y...'.......K.~Q1..Z.^.*..._..L_....~.m..8.aF.x.l..t}k.............OQ.;.W6.F..s..Rj9[6.... .&.Y.......;7..vAk^._...:........y....M2%7"....G._V.m..ML...J.n...w.pq9......G..F.p...sh~.9.....I..@....g...g..1.O..<f.{..jbP.Q.T.d.5....[............~..j...."34kj..^..@m$..G..+.Y$#S.*.....&.'.....#..t....K.p........0w....x.U.xgH..L.#/.A..!..I...x&....C|.......N...... 2.@..c/..K...4..'pi...mp.H.l.O*.I......g.BWm.K.`wj..>....tCWE....C0.0..F..Um ......i].\.|...........A.....3.S0...V.t@:.....q....Pa..R.v~...vW..h..D.s.D......}..F.#`s...5.............E.s..-.c...88n.....S......5X..i..l...J..-[.cp.9...C.3.s.c..v..Q.Q$..`.e..i......i46..wAt. .....A....{..%../.U.g.Z.Ig7..|H...v...\!..NP.......U...*.U...T.W.......o.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                      Entropy (8bit):4.959938568668223
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xpVL/ehSVnYDNNbUQ5nmMKAX8VXzALysqcs57Jwyn:jVL/iSuzbd5mMK88FA7srt
                                                                                                                                                                                      MD5:00431EF627E9B40E7B50C3586657D098
                                                                                                                                                                                      SHA1:806C0F23726DA7A8DCE625AB8981DB2549D8838A
                                                                                                                                                                                      SHA-256:39AFC8AD2F4ED178F5156862AEE0037FE410D84919AB6D3C588CC18A38820CD9
                                                                                                                                                                                      SHA-512:A83A0AEE5C834A05CE2C34EF8445A6D67CCC92B98A4B6029ECA9475667D8D88773F4E58BE3D8914B104A5A2E81E3E1F3C206689E64D6264086EF7C1761F917F3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010006..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/life.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.123923091383425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:GUREDVOEUKU+ptPitr73rYbRuaYN65w2d1x16T2/mt05I+s:GUNEUKU0hur774RGN63Xo9
                                                                                                                                                                                      MD5:BC39369552A83C4605FB197B6D4E076F
                                                                                                                                                                                      SHA1:227D9F5AEAFC9A58B3EA8382214122D6603263D7
                                                                                                                                                                                      SHA-256:688E832FE0C40A7CF4E5195EF9CB36914B1FABA99DE324B7865BCA2F43C686F5
                                                                                                                                                                                      SHA-512:F29CDEBDFD15522853A27F5D266008CFAA1BF72C43D522F9B9AB70B54E69B3227B755AE212F2156EAA391651E323E6DA80BD1157DBEB0149AC6081754F30D648
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................|||.............wwwy___=]]]<^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=___=___=^^^=[[[<kkkA.......................................e.............................................................................................................S...........q...................................................................................................................a...........{...................................................................................................................l...............................................................d...[...t......................................................w.......................................................9.n.B.k.}.......`.~.*.^.m..................................................................................................".c.........................:.h.R.......................................................................................a.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010006\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1690
                                                                                                                                                                                      Entropy (8bit):7.272208627759569
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVFLeT3yJ3VCLuG2dif/lXIrlss8t8Ig3XGi8/t/UYAieL9:QWHNn2qfaiJ3KuAJIt2WXGDV/4VLDwI7
                                                                                                                                                                                      MD5:9DB9DB4903D7E1AD0B26FD00F63982D6
                                                                                                                                                                                      SHA1:F5B1C5095D946DFD0C98EB143CD17F01E17B4377
                                                                                                                                                                                      SHA-256:686A61AF03640B0BAEB5946D06F3A0E5D0E146F767429B76EE5733D0F9D1A116
                                                                                                                                                                                      SHA-512:CDF363DCCAD5D997253DB4F1B53FD07B0B19332DFFD5EC4FD868768EED497A3C4A5AFDAC7E00982E011184074F5760BBF22391BA95AB5EA3CBE56799F4552F6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:FAB7FA9FFE5311E18FAB9597E2C2E77B" xmpMM:DocumentID="xmp.did:FAB7FAA0FE5311E18FAB9597E2C2E77B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAB7FA9DFE5311E18FAB9597E2C2E77B" stRef:documentID="xmp.did:FAB7FA9EFE5311E18FAB9597E2C2E77B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8]8....IDATx.$S.o.E.........(.s..v.( AG..4!.H..h..P!Q ...R.?AtiR.....$......r..K..........f..f..........-.|G.....?xy....r.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                      Entropy (8bit):4.96354868738225
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xTVLuXVnIkNNbUQ5npWp0oMKAX8VXzALysqcs57Jwyn:5VLuXSQbd5pNZK88FA7srt
                                                                                                                                                                                      MD5:C044B9480270FB60A72E994D7CFBBC0B
                                                                                                                                                                                      SHA1:76001BC99F03C05C9C10326DA9D04F4E5E4D1E5E
                                                                                                                                                                                      SHA-256:69FCA65D70DE780130CD6416B4332138E465035EE966FD52D8955646C6A7767A
                                                                                                                                                                                      SHA-512:076ED3587BAB4FF6FEBC7F9D54D74A1A37B885162E939B26388810421EB811C75B7F78F51BDCEFABC214B517952FFA13EBBF08B9391571F7871DB4A4FC1A5BF1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010008..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/fashion.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.664757497114004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:Ms5EgVHimUP2rbGknnpF6UuVoE1mRVY7uV8fSNWYfhl8/FJ0+6AN:t7Hn/rbGMpkUuV6zYuuSNWYir0+D
                                                                                                                                                                                      MD5:F023EC5F28C4652DE4EB7997B7B2125F
                                                                                                                                                                                      SHA1:D20156CC75F64EC63A9C4086308714E6FFB5FF31
                                                                                                                                                                                      SHA-256:1E395B7D62ABF73CBDD83FF9DA0FA125C29C330998F04B8F8E31911F88F1B43B
                                                                                                                                                                                      SHA-512:6514396B8DFE68C5340C13389F11A5C0DA7A1B5EB8A97AA9CD8C8BE1403FFCD9262F2AAAB22E8B548F3116C33233DFBD7105BB7FC8E92622CD4925C86C8EF8C2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................``a8...s...p...oxr}oy_.k~a.i~b.j|d.j.e.i.f.i.g.i~h.i.g.i.g.i.g.h~g.i.f.i.e.i{d.i|c.i~a.iy_.jxp.p...r...p...s`_a<................/0/......~..lV{.O.~._...i...e...`...n...t...l...i...x...y...l...k...s...p...b...c...h..._...O...kP|..x......FEH.................X^T.....s$..y ..x(...+.......2...6...9...;...=...>...?...>...?...=...:...7...5...0...-...+..x&..y!..y*..........???.............dp]..P..z....1...5...3...4...7...9...<...=...@...A...@...?...>...=...;...;...8...6...2...0.../...0..."...T......MLL.............F:P.v&..w...y...t...............}...........................................................w...x...y...y&..ZJd................,.Z.l...w...t...n...............u...............|...........................{...~...........q...r...v...m...*.Y................:.m.t...~...v...r...............|...............~...........................................v...v...{...s...7.k..#..........,B.x.z.......{...z.................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010008\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827
                                                                                                                                                                                      Entropy (8bit):7.3468622709312745
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:JwqNn2SJXatJ3E65j2WfLnVbZ9Hd4zGlvpkr:12h2gbDHdO
                                                                                                                                                                                      MD5:FB6F20EC94D8F6620BC4813CFD21E07C
                                                                                                                                                                                      SHA1:C9330A96AC7CBD4C30A7C67EBD96763339FBB23B
                                                                                                                                                                                      SHA-256:504FA6DBF57662A4F6AD692981E0772EDAF516D577DC9C73F0FF4BA856ACD8A1
                                                                                                                                                                                      SHA-512:3E1655C6B1DBECBF46F6842FAA0006F3E719651DDEDEFFA0C707412A5FD7BE07B1E97B915A1B16B0F5FD7625FD6CC91268470EACFDDCB5FC8B800B1264439105
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:EFA7C054FE5211E195E3932ABDA7E579" xmpMM:DocumentID="xmp.did:EFA7C055FE5211E195E3932ABDA7E579"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFA7C052FE5211E195E3932ABDA7E579" stRef:documentID="xmp.did:EFA7C053FE5211E195E3932ABDA7E579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Q]O\U.].s..;.03.P....".$...hS..T.....}3......&&&.'}3Qb....T..M..%B....3..0_...8.x.a...v...4..?Z..3

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.962132144658908
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xixVL7rVnmNbUQ5nlMKAX8VXzALysqcs57Jwyn:cxVL/0bd5lMK88FA7srt
                                                                                                                                                                                      MD5:46ED24D9C05D2FF8C25F2514E71AC4DE
                                                                                                                                                                                      SHA1:12862A40DAEBD9D306D88E903E355A298EDA55CF
                                                                                                                                                                                      SHA-256:4D8522BC9D0F4667943DD00526F6317E533F8E9D11F9459AF03B646C26D127A8
                                                                                                                                                                                      SHA-512:C0C42E208EB9A781565A66D4B25432BAE452D0F2F7C26491809D2AE9823659F6520D03040535EDEF50B298D08C53371AB736B8FC220BE81F278BE4F37CD45D2E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010009..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/tools.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):4.950724673411782
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:6LRdUSYknCN8AC88mHmjOZahs1JDlg3rl15tz8wnSQ3h0YoDoWSsiu0mtb7AqwCH:1TknCYjbjggoar7z8wSY0TrScspL6
                                                                                                                                                                                      MD5:5ECDCCB9FC99BD54FAFA7B66AAFA8E98
                                                                                                                                                                                      SHA1:4864F297BECCFA356E0C4BD52E7957A5DAC30E61
                                                                                                                                                                                      SHA-256:EEA96B28EC5B0004E0728D9C633C428287C64D80D6D65984B2DA5A38EB064B91
                                                                                                                                                                                      SHA-512:059634684795CB0B16E37188AFE3858A6DDFEF4B89F83BEB120FDF9B8C5E145C81C5A8F54B26B75D87162E5D2BCE9ECC0134D2E9B7842C2471EFADA2B6BB8512
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .............................8;?.%..k#..v"..s"..s...s...s%..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s%..s...s...s!..s!..s!..t"..x3Ta2............1Si@............................................................................................................&...............*WnG............................................................................................................................#_{K............................................................................................................ ................j.W.............................................................................................................................s.a................................3..............................................................................................g....................................................).........................................................................s..................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010009\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1573
                                                                                                                                                                                      Entropy (8bit):7.156172199592931
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVz/BoyJ3V8peGY2x8Ewb7RQH9wTdMxCKiInW8oOPh9+P:QWHNn2qHrJ3yeJE8f72i6v3f5JUP
                                                                                                                                                                                      MD5:839BED271E6C514A5D2EB7B71E6D4B11
                                                                                                                                                                                      SHA1:97B4D4D8178C0E92A47DF236EE8B9067E6E0474E
                                                                                                                                                                                      SHA-256:3D927AA49B006349F65C5D17CECFDB7B0066367F768ADE0A70A3C0D34EDC0E90
                                                                                                                                                                                      SHA-512:4496DE05F886E7D0EBC066C5F69AF30D84D180517C9A4ECB4C445389106B7B8E6E53985EBC4296D99DE2A1A5828EDFF30C5610494FCB98E0D7AC21417C67FC21
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:00C3D49FFE5411E18077E37066175716" xmpMM:DocumentID="xmp.did:00C3D4A0FE5411E18077E37066175716"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00C3D49DFE5411E18077E37066175716" stRef:documentID="xmp.did:00C3D49EFE5411E18077E37066175716"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..az....IDATx.L..j.Q...s..W..t.T..[..J-Y...P....@....gP..+..+..,.m.....6.6.$.u.w...~.;.s..Qj..,....T7P.g..?.Y.XaP.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.949950243042386
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xkmVLeVnBqKNbUQ5nfI5MKAX8VXzALysqcs57Jwyn:ymVLe3qKbd5jK88FA7srt
                                                                                                                                                                                      MD5:26312D153000D2C2F383C0F630E64E15
                                                                                                                                                                                      SHA1:9FD24B4EACD050A4242F8C18A2F94FC1BE9E2B04
                                                                                                                                                                                      SHA-256:2EAC776D15900830F6E53E15E6FE876DDDCE8E6AB0B247AA47DB1E7180905CD1
                                                                                                                                                                                      SHA-512:9F24BA99E85909F9C6A106D9A12365C525FF6537DFF525B081859DC901495FCA204B5961EA201D685FC31C31BAB848443AEFC958CDAB3038B2E34E4B541B9B58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010011..version=1.0.0.1001..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/mini/novel.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1150
                                                                                                                                                                                      Entropy (8bit):6.696759280646044
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:WWxaAbGln2PbNPx4vHfGd89oDpMZvf6Rbqr:WWx/c4wvHfs86DpMZvfqA
                                                                                                                                                                                      MD5:1C4DCAC9F552D56878D4A52FCAC1A7DF
                                                                                                                                                                                      SHA1:F188EF7E761D206FD1274AAE2F05431C012B3B81
                                                                                                                                                                                      SHA-256:4272C8895326A053B5DB012715BE6E925DEAC6C5686B385E231DB02A3E95D41B
                                                                                                                                                                                      SHA-512:949584652F9EF91ACACCE97D616F8D183F0D2AEC7ABDEB659F3E24DFFBA06D3F2EF83F503D87379FAF7EE32F5C48256F2B8564CA6CF4163D22014B97091FC1EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:............ .h.......(....... ..... .....@...................1[hZd{p.bT0.XY?.<h...>...9..6\}.*My..4z.)R..8h...3y..=..E.../W[/<q|.vQ..yM..{H..**R...........p...p.......s..${..........@..1ipJ7^a.wP..uT..|J..-%N......"....u...t..@...&~...|..#...$...3..0juS9UQ.s\(.ee8..K..,$R..B...>....z...x..?...(.......(...P...;.."HQaC[T.r_..clC..K..)%^..I...B..."....{..e...@.......)...d...<..%N[oM_S.vf8.`{\..L..&&g..R...L...(.......W...=.......-...q...=...ct{UdU.zb/.hqH..O..$(r..N...H...0..."...Z...@.......0...Y...9..+bz.]jZ.`..}o/..P..!+}..A...?...6...&...<...1...!...2...K...9..#Tn.ry\.w.......a...4...W...S...D...%...?...3.......8...S...D..%Y|.s{R./...;..e...8..2h..0c...I...5..:R..$;.......H..9l...K...V..l............}n.PH|.........F\..............................0c..s...............l|..........`r..............[x..............Gfjt(<AK........................Uv......................................s......................Jx..x.......................Q|..........(8=%Ioxrn..............)K..>l.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010011\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):992
                                                                                                                                                                                      Entropy (8bit):7.7713387585355544
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:A0BZmIxT556WHubIfgZwEt0Frl/S29T3WjvNepc:feilcfIfI/ErlS2VOei
                                                                                                                                                                                      MD5:844DDCA1D925E71E9B64DD39EF95735C
                                                                                                                                                                                      SHA1:12B52B95064E670B5C0DD0C1AAD4E1850537791D
                                                                                                                                                                                      SHA-256:4FE063A8E4F55F31B647CF4EAA29B3C1C77642A912582DAE0C7687133EF5CF2E
                                                                                                                                                                                      SHA-512:2573314F71A0F1DB258C34C9517C12710A32D60D83EEC7DAA15536D6EDC3B7136FAA7256D9DEF79BD1724C8A8D400695850BD04CCEF1AF55922BB9F5897DCACA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..SKh.U.=....y%3..$d.4..ABq..%R..@.)Yt%j.RQ.n...]Ku.. ..U.......J...j.G......u..v...{............"?.Cz 6v...c.....6.F.rc......~[..]..Z.z.\j..$.H.......+K.g_-=3.88:5l...w.|..xqh..w.D....{.[[{.w.V....kW....;..........."..P.D...#.(...g)K.".:.+....&....pb}..>.|..rb.....Q...).........*....3.Y...........#C..}...o3.G......K..A{^.~Q)..Rf.AsH....?..{..*U.....3'.w..;...pe]....yNM...V.#...."........}G..el....<8io.c._..OT.Q.._.o`..1."Q....:......*&.c.x..y....)..I...O.Q.L84....6".4y.n.C2..B.ohQ$.-.._....3][.5?.."...f+K..*U]e.......8........Eh.{....R.B?G].h...'-..P....Ip.Hj"..!.q...n.&..Q.:.R.C/a......%.&.65..$.F.T...._J.8$.-0b.......e.2......@..W.X..n.X.....|.......r-...=F...5...E......6P(...y..Y.C.^]>.....r+.c\.5... ......~...Hb$..J..q..-S.L.3.....9.M4:.mz.a;..>H.i...0......t....`..g i>0V...G..W.Q2..tdP..'!....(...Q.I.'....T6..I....QU.S}........... .....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                      Entropy (8bit):5.025645351265841
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xiovVVLHS9VnawDmNNbUQ5nuMKAX8VXzALysqcs57Jwyn:5VVLy9PDmPbd5uMK88FA7srt
                                                                                                                                                                                      MD5:D4E12D133CE4E63D87FDE596EDAC6D7E
                                                                                                                                                                                      SHA1:B433F4E9765670DAFCDCB9A6CB2FD7698AAE393B
                                                                                                                                                                                      SHA-256:9406E9933AC0D54302654482A0DA93ED7981E11C93E6D890CB591CB5542F4FF8
                                                                                                                                                                                      SHA-512:216AF6837F4DB96E5E0CAD0F0C5965AEC7156EA0CC4BFB7046D156BF8C8C19BE18290C6EDC6CEBF4C7B1D9C2216A2DA51DE6A5B4B1091D7944CB70217F636DFC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=102395752..version=1.0.0.1002..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/picture.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):5.306748975761254
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:j/ezRWrNDg/nHfXMw/IQUr7jR3yIflOnxjSROQjhZ:j2VW5DSfXMyUH1llO8RBjhZ
                                                                                                                                                                                      MD5:39F1AF5D20B5FA3BD8A9446A08E3F6A8
                                                                                                                                                                                      SHA1:5070BA1EE5D7D3596977B8E6B7C38CF12B492C16
                                                                                                                                                                                      SHA-256:50D0F6832BA9490B64C43EAF5EFDCC5F8D5641616047DD6065ECE79B0EBDC3F1
                                                                                                                                                                                      SHA-512:8BFC8F7526C01ED99668996BBF1439B6AF0DC72FF6A4702BF234B4DBC1F72B0DACBE71510F2BF84092DA820D228303D6A3CD582FFD73D61DADCA86C08E534A5B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...I...S...T...T...T...T...T...T...S...S...S...S...S...S...T...T...T...T...S...U...U...U...V...W...W...W...U...S...T...T...T...T...T...T...M...4..........................................."...^..................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010012\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1707
                                                                                                                                                                                      Entropy (8bit):7.290497360373356
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:QWHNn2qUfJ3r/3B+p8WjcGE1g/gmj2ggbLC0Y7:lt23h/3B+pdTE1gPj2ggbO57
                                                                                                                                                                                      MD5:16F57A2638753B17F72DEFABE38E53CF
                                                                                                                                                                                      SHA1:78D7687CAE55FBC059FA2AD6BBFD97B3567B3122
                                                                                                                                                                                      SHA-256:A5A4143320D633EDB78AEFA71F585888D58EBB1DDF6F6CFD20A61749B1523486
                                                                                                                                                                                      SHA-512:3C3973196D100CC8CE279C40F6A8C8FD7954FA89EB77AC655C2E174279534A2A4E02E13AD5DA2E64415B40459170A0EAFE2F13BA6C07B755766BE297C0150E45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7BB909554FE811E292EF98C5F7C4FE29" xmpMM:DocumentID="xmp.did:7BB909564FE811E292EF98C5F7C4FE29"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BB909534FE811E292EF98C5F7C4FE29" stRef:documentID="xmp.did:7BB909544FE811E292EF98C5F7C4FE29"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..vV...)IDATx..MLTW........g`.....7"...B.h...&M.....6.&..n.B.&.%a.6iH.IjR.M.5.q.`.# 0.....y.....E.'...'.s.....,..........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):321
                                                                                                                                                                                      Entropy (8bit):4.9662771090398525
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xVxVL0SXBVnXXKNbUQ5nVKKAX8VXzALysqcs57Jwyn:VVLJB1Kbd5EK88FA7srt
                                                                                                                                                                                      MD5:4720DA30ACD35F7061A009BF12097431
                                                                                                                                                                                      SHA1:4458795E744C92A6D3891AEBF0A0716896E8957E
                                                                                                                                                                                      SHA-256:423B5D3027D9F7F47168244DA4DEE695B2FC330C11E11BD622660FF199BE6D65
                                                                                                                                                                                      SHA-512:DCF023B0D3A2F4B550F0204BBADC7D74350F81035593C77361880635BAD00A4BC3AC03BF05688C7D0EDB240983C65892B964FB7582A004605417D3DD1E5449C9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010013..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/investment.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):5.800853721893965
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:haFaj+hpA4r/fcuLM2iji5PS6QHKcE9JvIHxJgFqsZXQFETuPDUvdsjd5w+XkG7J:h+Q+h+C/M2hQHKvfgsZXAIvCjMOkG7q0
                                                                                                                                                                                      MD5:1D03B03E28B1F81EA1B58CE87A667E07
                                                                                                                                                                                      SHA1:D98DE8B7B172475982EDB9EAC227AAB77A08A17A
                                                                                                                                                                                      SHA-256:197E99F7DB21D5776B92F4D1420174B98D82B1F5EAB25D3D9946B802D4885727
                                                                                                                                                                                      SHA-512:914A503E060FB6FB2A6A99705477B2955B460C0B4AF80182C9E1EBD21A337C89A2A242AFE9769BDD29448DCD8430FE5809EFD412DB4245CBA53E8C4162C0B6B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................B..,._..^..Y..Z..Z..\..]..^..`..b..c..d..e..f..f..e..d..c..a.._..^..\..[..Z..Z..`..X..P/.!............O".J.q...f..._...a...a...b...c...e...g...i...j...l...m...n...m...m...l...j...h...f...d...c...a...a...`...g...i..X4.6............U%.U.o...b...]...^...]..._...`...a...c...d...f...h...h...i...i...h...g...e...d...b...a..._...^...^...^...d...f..Z5.8............V&.U.o...b...\...b...e...\..._...`...b...d...f...g...h...i...i...h...g...e...d...b...`..._...^...^...^...c...g..^7.<............\).c.p...b...P...L...d...h...^...`...c...e...l...l...i...j...j...i...h...g...d...c...a..._...^...^...^...b...j..g<.N............`+.h.p...a...S...E...J...b...k...a...e..._...\...o...r...j...k...k...j...n...j...c...c...a...`...^...^...a...j..i=.Q............b,.l.p...`...`...W...I...L...b...p...a...X...X...]...r...w...m...n...h...a...q...m...d...c...b...`..._...`...l..rB.Z............m2...p..._...^...b...\...N...Q...`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010013\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1676
                                                                                                                                                                                      Entropy (8bit):7.212829335167512
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVKwfyJ3VF5G54o6B+DJtHQdHecKMdPP1oOGtVvvhPaq:JwqNn2SvKJ3d0bL2+viPyO6Pa05d
                                                                                                                                                                                      MD5:9CD270D5DD770AAC24E31A354622B6F3
                                                                                                                                                                                      SHA1:556EB8862702CE14A365BDAEBEB37B7B8BB8BB2B
                                                                                                                                                                                      SHA-256:E3A5419CAF661070EC8FAA0B2104CDE36A278B788829DA077CBA1E68F3794A34
                                                                                                                                                                                      SHA-512:8511232D87EEAA380F22B6683F2F1A4C78F2D7F0D5D91F6633A7BAB793B07EA80F6A40E46E43F17B9281C35D791C6AC8B48120F914C88CB5B509625C501C088E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:020B3D84FE5311E1AED0CEE83748DAC3" xmpMM:DocumentID="xmp.did:020B3D85FE5311E1AED0CEE83748DAC3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:020B3D82FE5311E1AED0CEE83748DAC3" stRef:documentID="xmp.did:020B3D83FE5311E1AED0CEE83748DAC3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,..F....IDATx.$R;l.W.=.3;.k{m....e..AB2."D.(...!. Q.@.D.M..iRP.KK.&..R.....!..l......^........4zs.=....?..@.....j.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                      Entropy (8bit):4.967324401143455
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x9WVLdVnSuYNNbUQ5n2m9mMKAX8VXzALysqcs57Jwyn:yVLdcuYPbd52m9mMK88FA7srt
                                                                                                                                                                                      MD5:2A0E5B9F974C4CF0F01B6B916FD959B6
                                                                                                                                                                                      SHA1:60CA4EB38BCFBA4DA1AAB07BF964642B0878FA0C
                                                                                                                                                                                      SHA-256:08594A9454BE5376EAF97020DFFC1497A147CC0CDAB6D7C4A1ECF04F0E86B4BD
                                                                                                                                                                                      SHA-512:E054BB158849E7C6596E8AE0B7CF641C21CF2D5211388E6DF1ED2935282889C7F5162B15EFA50E6B2FDFD98BB3ECA15BD62999DC78C665282AB36B1B54B2BE0A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010018..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/shopping.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.244375588470727
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:80oBnFFn1dAxOLarnebhRA+vMUvu5PZvuagihZNZv9XXgoFs2tiOCfnzP6oe9nd:8TdT1exOurneVtEUyyyNngoFH8nT6zd
                                                                                                                                                                                      MD5:39C449DFD4172C8FEF4D79D8F3ECF019
                                                                                                                                                                                      SHA1:B76585CD211E0BD19328FFB6A6BA306BC6245C4F
                                                                                                                                                                                      SHA-256:C0FF5EEA0BFF68D6A67AA730C16E704AF401CF5A60E5DEB7BD56E791F0A7F78C
                                                                                                                                                                                      SHA-512:B2C8BAA61223A3A995CC9827B1F8134A77594109495040081D399FE49391D56297A7E23DE71216537C747E068407A59147C6E41E35A8D5B1442E0AA7D0A44D00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................&...6...>...C...G...I...M...P...S...W ..X"..\#..\#..`%..]$..]#..Y"..Z!..T...S...M...L...H...F...A...;...4.....l.................aN.-.p.2.x.5.}.8...8...;...;...>...>...@...A...F...@...D...D...A...?...>...=...;...:...7...8...5.|.1.u.,.m..9..................S...o...{...........................................|..z..........................................v...o...6aa.................U...u.......................................}..........................................................n...:ol................(B...e...................................e.......q..5.u.<.~.y..v..n...............................}...[../sn.............. .:Q...r...............................i.......g..%.c.+.n.&.i.!.`.l..w..s...............................h...>................$#FY...|...........................x..........8.r.k..=.|.#.b.\..C...~..p...............................s...C.................-Qd.............................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41010018\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1754
                                                                                                                                                                                      Entropy (8bit):7.285789734958503
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:JwqNn2S2J3rJvlpu22AjzCy5bOONHYkW5tLbZ:12Z62lzCiNHYkWTbZ
                                                                                                                                                                                      MD5:D4C8F1DF118F8FC64AA4DDDC31F29697
                                                                                                                                                                                      SHA1:7AE57827226012EE65A4893A8070A9775F28A084
                                                                                                                                                                                      SHA-256:6B6F88BADF77410D370E663BC2B3980C1C48FBD52BAF156D86673EFB7F88D213
                                                                                                                                                                                      SHA-512:6B20F93F7213C37EFB1F684FAE64F115A32DED84108E42A54FD5A55ABB80DA87DB68C5CFE60460388F18DB3B359964B06635C6F0E1BB2500CB38431A0077A1DC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:CA5BDE84FE5211E181C6F1422FB0459B" xmpMM:DocumentID="xmp.did:CA5BDE85FE5211E181C6F1422FB0459B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CA5BDE82FE5211E181C6F1422FB0459B" stRef:documentID="xmp.did:CA5BDE83FE5211E181C6F1422FB0459B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9......NIDATx.d.;l.U...y...........$2....XD...........$$...@"4H....&.H)(....$H....;q0.........w.:.tns...9..+e..{......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                      Entropy (8bit):4.9686066710509476
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xViVVLZVnkJNNbUQ5nVlL9MKAX8VXzALysqcs57Jwyn:oVLZ6Pbd5Vl5MK88FA7srt
                                                                                                                                                                                      MD5:183747990356B87208C54FE122A7AD2C
                                                                                                                                                                                      SHA1:4296A5E0BB5B62A4E973E67CEB590484654332FB
                                                                                                                                                                                      SHA-256:94AED96FF80D2052397990FADAC17F56F2E2F810F39A9A20157D2AF7F44A7278
                                                                                                                                                                                      SHA-512:F70453499C91806D3DDEB64CDC24DBDD222C8E7BDDE7BA24BF6E893A4494CFA184A4A3DC1DBE8D0583A2A79C4A8444B8113F6A0271150853F142468EEB2C7849
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020002..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/news.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.502356981324228
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:KeCgIIwzEW5T4AN+8afhZ1tT6wVPIaCs0LH2AmW:KerIIwzBT4ANnar18wVPxqLWAD
                                                                                                                                                                                      MD5:D476ABA8D99BBF39C7CA914BBF30DD35
                                                                                                                                                                                      SHA1:5DF2375B3EBA919244D26A00E78DCA264A4C076D
                                                                                                                                                                                      SHA-256:93EF9FB51A4142EC5407799A0048ADE165E3EA335B2179BBE7E2B0917EB56858
                                                                                                                                                                                      SHA-512:664D6771A0B74BBE57C490ECB790B9C0CF1881367B13BF5E74DCE939D39E30C804A2755FA9C52D83F562958764C5B2C946A14AA13F2A4C3466EEADC7029F1DD3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................................................................................................................................................Cs..7h..<k..An..Ao..Du..Fw..I{..P...W...Z...]...\...\...Y...X...S...M}..K{..Gw..Du..@r..<r..;n..<m..7l..?s.Y....................-Z..5\..9e..?h..Ck..Mu..T}..`...l...t...~...................}...q...k...`...T...Mw..Bn..?m..;i..7e...]../g......................2]..Ck..Iq..Mw..P}..W..._...j...r...x...........................v...q...g...^...X...P}..P}..Jw..Ep..<h..2j......................6a..Jq..Qz..W...Y...^...c...l...u...y.......................}...u...t...n...b..._...Y...Y...S...Ny..Bo..4j......................:d..Rv..X..._...a...d...f...n...He..+DY.[}......^...'CV.Gg..~...e....FX.5Ri.b...f...a...a...Z...T~..Hs..6j......................=e..V{..]...d...g...j...l...f...%@S..0A.9Yr.....Ee...7H.Hi..}...Z}...9J.0Of.g...j...h...e..._...W...Mw..7k..?r..................=e..W~.._...g...k...m...k...p.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020002\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1747
                                                                                                                                                                                      Entropy (8bit):7.285774204678194
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVQlKFyJ3VagAqGdqIWoT3gmDRaLhXN5JXK3bmZ00dUO:JwqNn2SuJ3VPIWq3aLFN5U3bmHKdC//
                                                                                                                                                                                      MD5:571AF2707D1147E42B208A5B98F98BDE
                                                                                                                                                                                      SHA1:38E75672641FC4C836EDBF11473C362B8729363B
                                                                                                                                                                                      SHA-256:2F22D05B68B3A16479AE3D04686E2E422A8E734D1A26B2FCDC2A795979E8C832
                                                                                                                                                                                      SHA-512:F073602044EEDC1FDD1F05EB0E5B71284A392FC88C2692AA5C40A2E67CDFFD2647DE00A998A0E5D131C30744EA9820604280EE492E6699C6652AE0B4E7B23DF8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:1877BFD4FE5311E1B6A8F56F97B9BCDF" xmpMM:DocumentID="xmp.did:1877BFD5FE5311E1B6A8F56F97B9BCDF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1877BFD2FE5311E1B6A8F56F97B9BCDF" stRef:documentID="xmp.did:1877BFD3FE5311E1B6A8F56F97B9BCDF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..?....GIDATx.4RMh\U.=.}..7?.L'.dL...*...R*. .....E....u....].(.u.R.*"BH.A.U.$N.4...y....K...{..s...03d./8y......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):326
                                                                                                                                                                                      Entropy (8bit):5.047002109476319
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xV4VL9zKVnCKNbUQ5n/ky9MKAX8VXzALysqcs57Jwyn:8VLwUKbd5/tMK88FA7srt
                                                                                                                                                                                      MD5:B3010D5013CE394490FDD675EACFFEE1
                                                                                                                                                                                      SHA1:980A80543CF558C5B9C95E8B193DD1D27A2553CA
                                                                                                                                                                                      SHA-256:EF20DB1DE1250B46ACB32D5C1CE97F085FD67AFA421CF6F2DE6CD1F3A2042542
                                                                                                                                                                                      SHA-512:ADF00AE70CE375C535EDF3ACC7CEB48353B856A2F1D326E1D79A36EC9C72DCB486BA9DCAF4BA9DDAFC9637CEF4A22FE12D170C3EA0B636425AF6D506AF286B32
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020006..version=1.0.0.1001..name=..............[AppSetting]..icon=logo.png..smicon=logo.ico..title=............url=http://static.apc.360.cn/cms/mini/magzine.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.306713577547797
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:UM0mIfogLvt1rp5q0afKkwCrzT6vwXiZESw:UM0x/D7rDqFSNCrzT68
                                                                                                                                                                                      MD5:3F913DE1863481A1EB2D4400DF2981F1
                                                                                                                                                                                      SHA1:DDE8678AC1DDFEF0A6EE438CF4BF32E7B6274C63
                                                                                                                                                                                      SHA-256:5F5A309335670B3B63147D061C5C4523A656A43B44E9FD6BC5B77B057D76DA08
                                                                                                                                                                                      SHA-512:0F71EBAA314E6D7B62F90B463F466832678388E59E5AECFC46259400E0696E2DD24404CB51A57211EF6D838CACC04FDF820ED1CDBD23768525B8B44BE3E342CD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................FFF/rrr.ppp.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.oon.oon.ooo.ooo.ooo.ooo.ooo.ooo.ooo.sss.bbbh................uvvv............................................................................................................XXX.....................................................................................b....................................lll ........................................................................................+.................................iii&.....................................................................................I.......$............................KKK0........iii.........................................................................u.../...e.....]...-...J..K..U.........SRR6........}~~.........................................................................F...............Q....9.....5.........bccC..............................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020006\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):939
                                                                                                                                                                                      Entropy (8bit):7.715337267518902
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:TgnmyMGQ6rbGPaBviHyDAdqrlGJvk60U5:T8AIbGPaligdUvz02
                                                                                                                                                                                      MD5:2D40368B62CCAB60F49FA64586721507
                                                                                                                                                                                      SHA1:209354B6EB8543E4E5006CC565518888E26A5F25
                                                                                                                                                                                      SHA-256:106EE2D49EDCC53D777C46ED92E94D552424D5EDC1240A4D13CEBF7240BA004D
                                                                                                                                                                                      SHA-512:F6331635FCF499B090DBF6F3D42C3476A35B6A8E0DF8ED55358C29DA4B938315E4CE2CAB3E2884D12B7B65FD9DC5EC05D4B35D887ACCCBC86ECC90305E7B3D1C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..S[k.e.~f......nvvc..mk+V.....Ik..(...(.^.......j..!x#.w....x(..sE...l.4.f7.=.y>..>...y..y..8...|.....5gu....f. BV....Q..S$..%....5.:0..7.o..es.....>o...j.OpMB.bb4.@.5........;..C.=.+...W.XE?#.P..UK......n\..@e..N`...a.....j?.$"<.0&3.R....g..{B*....H:...gI...B.%.2..#8..L...w[.8..Vmb!....'...GO^..`....PX<.k.=F.!.Z..9D9E..8...-s../.P.&>x......{E-:._4.d....a...LL9......=uf.......t.r0x.&[.-...*..D..$.dYF..0..&..4{$jA.H.4c......;.uG.....'.9...p]..j..O..Q..a...".)R...eY......F.s_.u9.`.6.8.O.3.c..a.7....p...R..#.X}"-.....B.@Z%...".p..\(........e...J.r....N#._..sP...)....K.sH8......`."..eL..........:g#f$.i""........Y..}....(.......~:..G..,O.8...y....N'.....h.X.I..aU...........#.,....P.Y...!.T.`.$...?o....^.......&T./P.I..v%.(.4.....R.-O.....,....ah..bW..n?.lnn.'=....QQ.KC.j..o.....W..r..P.{..A..v..`...6{_.{....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                      Entropy (8bit):4.990346257397384
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xJuWVLNxVnJwNbUQ5ne0oMKAX8VXzALysqcs57Jwyn:+WVLNxUbd5ZZK88FA7srt
                                                                                                                                                                                      MD5:DADD037E0FCAF23F1FB8AF021329E6F8
                                                                                                                                                                                      SHA1:FA4B3498B7FF91AA83036858902470B79ED44B3F
                                                                                                                                                                                      SHA-256:BA919B0A6784A419D67BE03D57138900416A8F3896F744A8308026F846D8C634
                                                                                                                                                                                      SHA-512:518B340222FFFF911053313C02A096D162EDA835B76945FA06837DF5C1EE86D783BF8DC83BDF32A521CFFC5AEFEF230A9EA67B33EC98412345F115748BDE5FEF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020010 ..version=1.0.0.1001..name=............[AppSetting]..icon=logo.png..smicon=logo.ico..title=..........url=http://static.apc.360.cn/cms/mini/education.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.08454985861445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Y96oqv8mYYZ2cbO752hMe5Drzv2nEKZZtP4hbBO+CG50Js0UOX2bEFalXy0rE2GE:AUeYZkwpXzvaJfPOYycs0EVlCBrECc4W
                                                                                                                                                                                      MD5:1C48CB227F217912E6CCDB2B1D95B9DB
                                                                                                                                                                                      SHA1:ABD047A0933CFD377F2F16AD2AF9577D53E8CEDA
                                                                                                                                                                                      SHA-256:48048E284E74ED98B89470BDA05F48CF6618745348D64BE08D7789CF5FC4BEEC
                                                                                                                                                                                      SHA-512:20209DE59D8233EB200D6D5F479389439185CC70542880BA57BFF289564CF00CB1C9243FCC9AF2F833B0AA2F60F7FD27C967DC72A39AA3E6697E80A1929E1C47
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..............................1a*1...7...7...6...6...8...4...6...8...7...6...9...6...7...7...7...6...7...7...7...7...7...7...7...7...7...6...:....CzZ.........@vIH...J...L...G...G...J...E...G...I...G...E...I...E...G...G...E...F...G...E...E...G...G...G...G...G...D...H...Q....Z...........L.QF...B...9...P...S...R...O...N...N...M...M...M...L...L...L...K...K...K...J...J...J...J...J...K...J...P...@...K....a...........S.`K...9....Yn..p...p!..n...n(..q"..r...t...p'..s...s...q...m...j...k...m...p...p...n"..n"..m'..n...n../.X.T...H...!f...........b.iL...9....PY..\...\...\...Z...^..._..._..._...^...d..%n..(p...j..#l...a...V...Q...R...W...[...Y...Y...W..K...K...%m...........[.wN...9....TW..b...a...d...g...`...^...]...]...^...a...^...f..6|0.].^.l.k._.a.N.R.1x ..g..._...Z...[...^..I...L...)v...........T..P...5....RN..c...^...h..X.Z.g.i.j.j.U.W.c.d.v.x.K.G..k...[...R...R...]...h..7z7.O.M.X.X.U.W.R.P.*s...Z..E...L....|...5h......`..S...4....SG..c...b...[...[...k..3}

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020010\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1741
                                                                                                                                                                                      Entropy (8bit):7.282943200865706
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:QWHNn2qdIIhEhJ3d5eiPfmu+pYsjpHN8dCw:lt249+8int+pXpHNg
                                                                                                                                                                                      MD5:A640F4C64FB4808A4DBF2692BC409C42
                                                                                                                                                                                      SHA1:0B9CF0306C4839FED20F12BA509E265301CECD09
                                                                                                                                                                                      SHA-256:1C0DFAFD20B039526B3DA6ADB2B3A4D6D79AB5A2E4CBB22ED9692053EA9C789D
                                                                                                                                                                                      SHA-512:0CD3BF150CC5F45594AEB949218FFF0CBC06D44592FC60A12CB4DEA0C6ED904504E6DE9F8736F91B37029C63F0996AFBDD8E28C853AB3C65350967D9FBAD1D72
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:63D5451FFE5311E1AD2FFA46191422D8" xmpMM:DocumentID="xmp.did:63D54520FE5311E1AD2FFA46191422D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:63D5451DFE5311E1AD2FFA46191422D8" stRef:documentID="xmp.did:63D5451EFE5311E1AD2FFA46191422D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Ots...KIDATx.TS.o.E..fg...Y..7.7..4....P.....Th.p..pAH...w.\..8 ..{B.*.@.....Q.+$i......]..Y.X.ivF....}.^..e.xx...w..Z..Gw.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\back.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\config.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                      Entropy (8bit):4.98799339009139
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xXsVVLjwVnDFJNNbUQ5ntIEE/MKAX8VXzALysqcs57Jwyn:psVVLkd7Pbd5tIEEMK88FA7srt
                                                                                                                                                                                      MD5:CF905DAAE5C004070EBD349716ECC479
                                                                                                                                                                                      SHA1:BC2A567CCE58FD7343441764B023B59D23883997
                                                                                                                                                                                      SHA-256:74CCD3D8E720295A9BCAA7A8FF292F420629E61D718E7AA258CD5C4B854FF090
                                                                                                                                                                                      SHA-512:89B9C36165C38230D17BE02D35E9CA208DB8E69835570C91C02913DB402C475034B65EFB0D1993C00429699B2CCE987ABD7BCAF883980146D39E7D928A41710C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020022 ..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/female.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\logo.ico (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 48x48, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):6.528254274979402
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:49hekd/ODFoHCkc+O/8bCyFoO47gojnHKC:4fexKHnO/5yFotkojqC
                                                                                                                                                                                      MD5:D3BF36DAC2268F5C5EFC74FE319E1A2F
                                                                                                                                                                                      SHA1:07F3E64272EC80535AD1E8B908396D94FF757C39
                                                                                                                                                                                      SHA-256:C121021AE242D8128A95C4DDCFA6EA651C6479263D7A4C2E936285C6609D3C45
                                                                                                                                                                                      SHA-512:7BD42380CA2BED8E9F0FF3E2AC7C6FE3F7981F9CF6C634D5FC5AD4F7263791F96698600D3BF53DE45B4E83B9C1A4522C61173D5DF686E8806F98707BAC60E544
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .....6...00.... ..%............ .h....6..(... ...@..... .......................................................................................X. .^.%.c)".\A".Zg&.`.(.c.,.h./.l.1.n.4.p.2.k.5.n.......................................L...Q...V0..YA..VQ..Wg..Y...]...]...\...^. .`.!.c.".e.$.f.'.g.).i.,.k...m.2.p.6.t.:.u.9.u.9.qL......................5%..N...Z...Y...Z...Y...[...]...^...a.".d.$.g.,.m.2.q.3.q.>!x.J-..K-..T6..fG..hF..oM...Z..{U...l..~\..J"..O).,..............#$..J..._..._...[.#.f.C,{.S:..^D..\A..mP..uT..qQ...^...\..{X...a...\..|T...V..{O..zG...G..x8..{;...p...n..._..xW.b..............2...]...`...[.3.o..j...a..}M..tC..s?..t=..n3..h2..g-..a&{.[&t.Y#s.R.l.R.l.Q.k.K.e.J.b.J.a.O.d..H...h...^.................#...@...c...^.&.g......R..K.j.I.h.J.h.Q.p.L.i.M.g.L.h.L.h.O.i.N.g.M.f.P.h.N.f.H.].P.e.['o.S#h.yH...c...a...x..................*...H.#.f..._.`F......p6..I.f.G.c.H.a.I.d.H._.K.b.O.g.R.i.S.h.P.e.O.d.N.b.Q.b.zG...h...o...l...k...c...`...q..................,...J.&.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\41020022\logo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1090
                                                                                                                                                                                      Entropy (8bit):7.76613347959362
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:/REn/yTUsvAI2o+Zh2w28u6io330GZwL96cDUwhW+89:/+n/Y71+iw2Fo33JZ+Ecowhtu
                                                                                                                                                                                      MD5:F441D279A97A40FB7DF8353BA76BBD7F
                                                                                                                                                                                      SHA1:6EB2170AA2A9A989468B969FD78318A9713CD801
                                                                                                                                                                                      SHA-256:52D4D1D796EB2D4DE9BDA84DE6055CB81B1DA303BC6FCF70D5CEABBAAB716DE0
                                                                                                                                                                                      SHA-512:88BE0D88F553AECBBC9DCD6276F9063AD913F1237E733C35BC17F5A8C4BC34F4176AC4868E448455ED4D087E13FEB9A2BC92C7E460B86CA164BA3D6DC51807A5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O5S.L.w..M.....C...b.BQA..k.p..CD...t.R.RZ.>....8...XQ!.K.0..-.(...P.Mq...5s1..~.k.K......r9B.`........6.\.O.?..X..'........q[...b.}.Q.}.*../.....*......c..'..!0..g...=h.F........2jN....6..=.>.$tBw8.#sv.x..\.~....H..A....];.....(..~.L..7)..%.N/+...Z.-.r...(......nD~"..s1....eKP,.a.......U.be...9=.....f...x18...Q%.DlH*..Y...4......V...K(...TJX..|....k.......w..@..>.2.r../@.....r.+kqY.j.it...9....8.Yjz....=....{E.........B.j.q.S.N......s.A.g....\........F......... ....(..Ji%..l.:..B....)e.p..Nb."...T.P......$.<-.y. &8..P.....r..........A|H.j$..R{5..;lRe.}.~i5f.Mh..pJP.|.Q.y.Q.P.....[o.8O.............@...."s..m..0.7....>....MY.b@{.....d.p%....v..}.r.....\.q..._4.K.-8.~a.........QH...O..\+....#..`.j...'.'.....uA........RB.%...\..!.=.<Z8.>|t..a.G..4....n..6p.F|.p*....}.@..@.w........D(.<.=c........U0.i..s.0.G..!.........m].........~..E.u..A.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\InnerwebIDDict.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\MiniAppdata.xdb (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\MsgBox.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):510696
                                                                                                                                                                                      Entropy (8bit):6.459926518380195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Kb+/Ln26GlBvxG4stUgGC9PkPCEFnKowWTa6Gh:n2HBor9PkPCEko7Ta1
                                                                                                                                                                                      MD5:486C38F163027600AB117D4D1BA6F254
                                                                                                                                                                                      SHA1:14997ABF08A3D2711209FC617D2AE91033AD8BDF
                                                                                                                                                                                      SHA-256:0F7DDE159F497F194267B1400C05DD9304805B6B6AEE2A923F86C6854C38C65D
                                                                                                                                                                                      SHA-512:65CD19982B9EAD7FEE58414B48D24F5BB99FDCA882E20A396153CA7BB10FA2F9FF15B6C97634EDB29E0AE5F926C5044382C8C45288E2520ADAF2F004C6DB5F2F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z.Q.z...z.Q.z...z.Q.z...z...z..z..Jz...z..\z)..z..[z...z..[z...z..Uz...z..Mz...z..Kz...z..Nz...zRich...z........PE..L....P.O...........!.....F...d......v/.......`......................................._....@............................m........... ..<>...................`..XU...f..............................h...@............`......<...@....................text....E.......F.................. ..`.rdata..MO...`...P...J..............@..@.data....j..........................@....rsrc...<>... ...@..................@..@.reloc..(....`......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\MusicIEFrame.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):584000
                                                                                                                                                                                      Entropy (8bit):6.594932333601168
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:JGonh08rgTC/lBz7ZJJU6O0ksHXZwf5kbtwd3pMg0JeFR9Pz:JGcvroC1JJg0H3GYtwzT9L
                                                                                                                                                                                      MD5:45DB84CAC7279600FFE76EA7DEF6839D
                                                                                                                                                                                      SHA1:0FB498863ED8E0DCDD495D2171BB950CE6C614E2
                                                                                                                                                                                      SHA-256:82E0C1FF9D3E88715D36B2E05E66360434C7D0AF0F8CB28E299E156544093B5C
                                                                                                                                                                                      SHA-512:392ABF8B63E71DA621408A195CF21959D29521B8AF1F71521B06D4B89EF4A9562184F515FFA12C4AA46B8860DC9015C801042EBAC4204858FC2C64C433982052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i@N.............p.......p........C.......U......./......p.......p.......Z.......p......Rich............PE..L...].[Q.................&...................@....@.......................... .......~....@..........................................`...w..............@.......t;...D..................................@............@..8............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data...$N....... ..................@....rsrc....w...`...x..................@..@.reloc...=.......>..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\NotifyDown.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\NotFound.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\Worning01.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\mhead.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\ProfileTip.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\0.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4502
                                                                                                                                                                                      Entropy (8bit):7.913847232220015
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwn/ea+W+62BxX07:/ShuweflgTMEEO0nKZ1R8ehBxk7
                                                                                                                                                                                      MD5:03443B5ED06C4C0578E49FA140B1C6AE
                                                                                                                                                                                      SHA1:0BCE94FA69102EA0CCDA90E42EFA4C070895426F
                                                                                                                                                                                      SHA-256:A3AB9D0CC16B534EEE0ED9074CF0001EC13C47FAFB2ABE5A77C410DBF38ADC7A
                                                                                                                                                                                      SHA-512:9E557DF066DD9B8285A141EEB483783C649E425A088495BC2DB9B2EB18AD1141F98F71EE049196FCBBA1428573938D9F020358D504A1C08EDD044DBBE614D867
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\1.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4720
                                                                                                                                                                                      Entropy (8bit):7.910929199552645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwQ9IYDFUcX/Il1TXQNtWoH:/ShuweflgTMEEO0nKZ1Rf9IYD+I/O1Ta
                                                                                                                                                                                      MD5:82C2A66ACA005AE47EFA6CE326ABFE76
                                                                                                                                                                                      SHA1:1009671F3A2397528232F773590F251B1361567A
                                                                                                                                                                                      SHA-256:A78939D1E1822D661C18905BF4FF002B069FEEB9E2B61443D6F8BED68F4BD3D3
                                                                                                                                                                                      SHA-512:1E66793FEF142158EE9F767BBE66D3020A200113644D76A3E9F0BD0A07A19D0A645870F911B1A19086F7474043A1A04F17812CF76F4C7B5FD9EBF996E0967599
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\2.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4745
                                                                                                                                                                                      Entropy (8bit):7.906551448003165
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwA9EHczkCM5yRyM0ADjr5:/ShuweflgTMEEO0nKZ1R56HfCDRyzA3N
                                                                                                                                                                                      MD5:C948EB58717C808198DCB2253535C068
                                                                                                                                                                                      SHA1:1E9FA3456ED43BC6F1688D38B44F28C5BB79F76E
                                                                                                                                                                                      SHA-256:D78BD49006A2AAD356F7C043593256241A4FC2A7E63890002BA840BAA1027BBB
                                                                                                                                                                                      SHA-512:E2748AA2D7EB462FB9B21E408A479B993A52B5DA8499BAAD6686F8DEF0FE7AB53B1D7AD686BA7174E85A2C08F64D1C52D4518443849209BB940C943F1796E506
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\3.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4784
                                                                                                                                                                                      Entropy (8bit):7.91968879390982
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwnhfMROht+7hLUBvVqOmEw0K:/ShuweflgTMEEO0nKZ1RkhghgQw5K
                                                                                                                                                                                      MD5:6FAD4397D817D28386B5888AF6E596F2
                                                                                                                                                                                      SHA1:7922E4782457C1478D85B14D5DD44F3420A16076
                                                                                                                                                                                      SHA-256:59394F229FD727EE54E4A93FC607249FB79C4E1CED49CD55C5F36D07D9F493F7
                                                                                                                                                                                      SHA-512:70AC2D8BE829BB7B021211F83E71E3C1B546C8A9DA72A0F323ACFA6E8884D72AA64C097A2B95FBD7E0D133D0BC48E73F69D95B956C2DC616454083633FCB7994
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\4.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4833
                                                                                                                                                                                      Entropy (8bit):7.915121783505522
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwY+6DKmz4RH7/QUBCx18Oi6O/t7Ie:/ShuweflgTMEEO0nKZ1Rf1uFH7/Q2C3e
                                                                                                                                                                                      MD5:D9BA67EF6CFEAD7F1A62E579904241F9
                                                                                                                                                                                      SHA1:98C13A03B56900C28E4DB7DB13A807D15F7B0AA6
                                                                                                                                                                                      SHA-256:80199A066CB6E29A4131F034E92A22F687E097554FCD15D0497B6553BA04EB28
                                                                                                                                                                                      SHA-512:434D4617638ACDD0A505A6F47613632FA7846F5857B554399393D716BE43F741A08C36E40219755A21A5764CB4348093BF6184B492A4445E5804C10DCB4CE2A5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\5.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4490
                                                                                                                                                                                      Entropy (8bit):7.914756290833229
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwB+/ZRK0UhYQ12wau1:/ShuweflgTMEEO0nKZ1RI+T0x2wp1
                                                                                                                                                                                      MD5:F8D45187D602D6B6BA49A4460695EA55
                                                                                                                                                                                      SHA1:DFDB711F7E5AEEA31D41639E0477F4A7DFAFC0A1
                                                                                                                                                                                      SHA-256:140347F6A1F50B6827359EF961F31CF7F7FB2B800FD730C21AAB437FB1EB4905
                                                                                                                                                                                      SHA-512:E1382EAF8A4BBE93A48AAB86E3765133AD841CDB74D2C7B78B053DB9CECEDAF41E0425FE9695A1B1CBB386321B4BE919FB94603988D7658806ADFA7FC0B7121E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\6.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4628
                                                                                                                                                                                      Entropy (8bit):7.9134281959066355
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw7DTfI/ya4WfUiW0B042od8:/ShuweflgTMEEO0nKZ1RIDSxfUiHB04k
                                                                                                                                                                                      MD5:6EE23E80FDF87305D823AF28A755F479
                                                                                                                                                                                      SHA1:F1F5AEB82A11407B46EF88171B0CE6E32BA33515
                                                                                                                                                                                      SHA-256:B22B3DBE0B1EE0865A44343C598042E29B05A63E4647454ABE288F3612B1BF00
                                                                                                                                                                                      SHA-512:FF2CCC273A063BF4D3F302FDC8384D63035EE8F071DCBEAD710CC94C173764B331ED26C356E5BF688B7761555CDB263405F2B88F6748D4A70CC380701A868C5A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\7.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4450
                                                                                                                                                                                      Entropy (8bit):7.908145383039164
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwmWJ8muaMMYpnUF7WavfP:/ShuweflgTMEEO0nKZ1R2Jx/Mq7WEfP
                                                                                                                                                                                      MD5:714DA01FA83B494EBFC4B0431A435578
                                                                                                                                                                                      SHA1:A03B48EED86BEED3302D638967C2321532A4786E
                                                                                                                                                                                      SHA-256:BC7A1749B485C7DD596E47AD2C333AFD4C618D4BCB6AC778AD22D2021CD5DE81
                                                                                                                                                                                      SHA-512:1BE5417627205B56365963C6987E1AB0DC2E7EB8FAC2216491A4ED0FA77C354C7017CA80C0F75106EAAB9C27BC836DCF6BC72BCAD4DCE91D0D21835F348B3E48
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\8.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4500
                                                                                                                                                                                      Entropy (8bit):7.917985621284803
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwWa8zQiPJUBoMdpWAc0m:/ShuweflgTMEEO0nKZ1RK3mUBoOBm
                                                                                                                                                                                      MD5:A1D584A6F5E61C876A18AB41838167E3
                                                                                                                                                                                      SHA1:32338EC7EE370EEAC323D7F4E08445B0E034F083
                                                                                                                                                                                      SHA-256:2F818AD9FA9E8022846E67E1B7D3B63530FB7CD5AEAA82FF6331679D11EF40EA
                                                                                                                                                                                      SHA-512:017B8CEC7199EABA9D2AA1D8442AEAFD134E4C461DCE436D71D92AA2017E7ACCFDDE325DF8F3876F65BBD64D86A910766886698415A0A04D1D6CCEE416270672
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\9.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4252
                                                                                                                                                                                      Entropy (8bit):7.914745740309695
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw8ahU0JOI/nfAMB:/ShuweflgTMEEO0nKZ1RKU00IQM
                                                                                                                                                                                      MD5:C49CA4AF0CD038C8E94AE523BAF96AA3
                                                                                                                                                                                      SHA1:6A5DB9C4D78D1ADE228D589402669CA798F49055
                                                                                                                                                                                      SHA-256:C6CD29C7CA458D53F98E05531EE0DB54162A07676A93EB7ABAD5DD612AE262D6
                                                                                                                                                                                      SHA-512:04FD518735E92B4B495A0B3402477E31C25A414B96E32923280E1CC4B9A7758A19ABF3C9453D63F7E1976B9D4F9F9195E9ADD5D8CBB0239EE3F0B4791B2F93C8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\PswImg\PswImg.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):150
                                                                                                                                                                                      Entropy (8bit):4.496733935873367
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:QA/oeLl5VgC6fU/ubC6hNvJPhiM9TERQIC6IgBEoAovM4KgxeJvn:QoLl5kkubC+BHsQICfEEdHpoeh
                                                                                                                                                                                      MD5:F381D25EDE8E75B43B15812D34639F31
                                                                                                                                                                                      SHA1:4737138A26DFAC9A951EAA61284C474BF9E91D33
                                                                                                                                                                                      SHA-256:2CD7942D3CC2E3B374AADFCF8845546680B4DBC7CD49D939C9B8FDF1E30F92A6
                                                                                                                                                                                      SHA-512:402A706B8A885EACAD5F704028CC7CE38EA982F25FC03F557AFBCC0416CED2A1796501FC80BC337161DCFE4C692E19667010E820FDEA1D336F91D3D08E371E91
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[images]..count=10..img_0=apple..img_1=banana..img_2=orange..img_3=pear..img_4=tomato..img_5=beef..img_6=noodle..img_7=rice..img_8=fish..img_9=pizza..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\RegSMWebProxy.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):94360
                                                                                                                                                                                      Entropy (8bit):6.439301229562193
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:EBw4ZQDGLJpVScRDdF26vamLBOgm0j4kLcq+UL1nINzs5FKSXssRwCaM:lVDGL4MRTLp91VQs5FKS8vM
                                                                                                                                                                                      MD5:65CBBA195B71603A4FFB7F7F85CB100D
                                                                                                                                                                                      SHA1:867AEF9332BEDB8A226EA43B711F7C39B77E55D3
                                                                                                                                                                                      SHA-256:9A95725D30B843B195EAF7848B5A1F45F9542C3607F1F394EFC00840D1D2D61A
                                                                                                                                                                                      SHA-512:7A539AAA037B05B960918B635D19AF4538468B280AFDEA747AED9E3E7A9EAD71C44DB2C594C9C91D2703F85969A86D3D654C5AC93A117E873C1C7BB093A253D3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..J?.u.?.u.?.u.6...,.u.6...S.u.6.....u.....4.u.?.t.L.u.6...5.u.!...>.u.6...>.u.Rich?.u.........................PE..L....q.O.....................t......QD............@.................................S.....@.....................................x....p...............T..................................................@............................................text............................... ..`.rdata...5.......6..................@..@.data...|=...0... ..................@....rsrc........p.......6..............@..@.reloc...............<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\SetupUtilDT.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170344
                                                                                                                                                                                      Entropy (8bit):6.515376474233682
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:X8cE5RULjRoG6LVI4P7+lLdoL6qY0foiStJv5LULIebzLo:Xb0RUfaGiI4P7+lLKmswRPtlG/o
                                                                                                                                                                                      MD5:301A4BCA1A602AAD88C5E21AE2A8322A
                                                                                                                                                                                      SHA1:73AEAF28C654C8AE61BABD5681160783520F5963
                                                                                                                                                                                      SHA-256:977B181508CDE3EFFDE19A22B03127626AF6D96B6ED0B29B7AFB514B1646672E
                                                                                                                                                                                      SHA-512:0A00B9274485FC4CA8EBA9BA90161AEC950034804076C79E4DE7DF76E971FFF179349E4BF6F72EF4F53D357E2D5D19584B7322C9C8D2DD1DE55BF2F1FBE22209
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eqz.!..L!..L!..L._.L ..L(h.L6..L(h.L...L(h.L...L..oL6..L!..L...L(h.L0..L?B.L ..L(h.L ..LRich!..L........PE..L...R;.Q............................=.............@.................................u`....@.................................LE..........................h...........................................H1..@...............<............................text............................... ..`.rdata...R.......T..................@..@.data....3...`.......D..............@....rsrc................Z..............@..@.reloc...$.......&...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\SwitchBar.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\TopBar.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UiFeature.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UiPluginManager.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UpdateTool.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):104904
                                                                                                                                                                                      Entropy (8bit):6.415069485363196
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:IhlPjE30TlqLk62khxYOR8HIfsgjy8Lw1MACpfKT6FTS5iMVnwCaR:IhBjJlqLl49GpjHLwEfjFTS5i2nuR
                                                                                                                                                                                      MD5:9882B5CB410EAD9CBF994D3473E042F9
                                                                                                                                                                                      SHA1:C20212130A3A209104D8E7031ED8108E42D56C1E
                                                                                                                                                                                      SHA-256:170B0F6255D1F3B4A8512353ABAA59D2B89D95D282F630782D7AD1721C849A66
                                                                                                                                                                                      SHA-512:A0815915D407C46115719CD5D3B569E5F8D26FCC8BF46339C830E24242291BB961012A24221E08937D1AEA434BF4D17B13EA5E75693F657FE2B396AC5B165FD3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g`\.g`\.g`\...\.g`\...\.g`\...\.g`\..\.g`\.ga\.g`\...\.g`\.5.\.g`\...\.g`\Rich.g`\................PE..L...}..P.....................|.......n....... ....@..................................S....@.................................xO..d...............................p....!...............................@..@............ ..t............................text...c........................... ..`.rdata...7... ...8..................@..@.data...`>...`..."...>..............@....rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\UpgradeData.xdb (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\addapp.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):682
                                                                                                                                                                                      Entropy (8bit):4.909863438974874
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:7WWZowjIzisjIXyjIirbHToONjoOiONsW6Yo6suXmMjIQ60TO7KwhoA+EoMOb:7WSj6isjRjTrbzoONjoFPlYoHDMjpFx5
                                                                                                                                                                                      MD5:8BFE9D0B36CB07F1EFD8EF5447120ED5
                                                                                                                                                                                      SHA1:304077E511928CC7F35D9B20E5C76F4FDDBFF64E
                                                                                                                                                                                      SHA-256:BB8611D4C1CDD69DD0024768A782D4FAF9D40357EBF5415B4D92F7676EF8CABD
                                                                                                                                                                                      SHA-512:501B6B3B7502F7FB47B7649580F313D20E4D0C1D1E38701E2CB16C0059C0C595820D95FD7C46DFE79F1C424E7614CCD3599BE9FE0478F96B3755A5E448897305
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<script>...function Addto360Desktop()...{....var title = window.external.menuArguments.document.title;........var url = window.external.menuArguments.document.URL;....var parent = window.external.menuArguments.window.parent;....while (parent != null)....{.....try.....{......var uu = parent.document.URL;......if (uu == url)......{.......break;......}........parent = parent.parent;......url = uu;.......}.....catch (err).....{......break;.....}....}......if (url == null)....{.....url = window.external.menuArguments.location;.......}......var obj = new ActiveXObject("DesktopMeunObject.DesktopMeunObject");....obj.Addto360Desktop(title, url);...}.....Addto360Desktop();..</script>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\bg.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 682x370, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):34299
                                                                                                                                                                                      Entropy (8bit):7.886401642174046
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:49GOMIVwO5aeCKHpstGctFhM0IkE3ountxkOu3miS+PE2FA0ETeBm:4kIVNMoHpsgc7esS1noOuWi9E2K0Ef
                                                                                                                                                                                      MD5:B550092E07391F8185F571A9FA468123
                                                                                                                                                                                      SHA1:E46E480DBD44D633D9F3208D2082EF5996102B98
                                                                                                                                                                                      SHA-256:BC079E3B3307D409A37B511DB9DDA0BC7C37847A4D1D370B33B7926068D2EE19
                                                                                                                                                                                      SHA-512:375640C3656B7FCD1225DD5D15415642D1541B136A9190B83B32D8542B942BB0083AFDEB8A11AFD4DF81FEE09821990976866B17B2658DFCDE3B121D2C027536
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`.....XExif..MM.*.......1.........>Q...........Q...........Q...............Adobe ImageReady.....C....................................................................C.......................................................................r...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....p..-....R..P...as.......)..iw....)3.z...Aa@.T.J.b......Q.H.....R...{.......ri. w....o.._.c....@..U....2*;K...J.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\errorpage.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\img\body.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2012:12:07 10:58:08], baseline, precision 8, 1300x900, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):38959
                                                                                                                                                                                      Entropy (8bit):5.853823250628968
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:XjgIrjnsIrjn3U5TtE62Eop6tToxVWB0MPrEW2sfjPqxIbIrvBU:XjgIr7sIr73wtE62p6oFMDEW2szbcvK
                                                                                                                                                                                      MD5:D09B2C3955C3CADBC31B1E4A6523C188
                                                                                                                                                                                      SHA1:BF142841A6E5B45943D1C74431A349988D8858BC
                                                                                                                                                                                      SHA-256:4F4C74A700CBAAB12B3664F3824E5B681F7929E4DAC2714F497D6C318A309D9B
                                                                                                                                                                                      SHA-512:56C5474513B05F73AE514BAAC38EAF02A8ED94C406EF4E0A5B036E36080D210CF94C44076F35A235D71E77CBC9C11F900CFF71E31DA805CA2B4C5F435BB397DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS2 Windows.2012:12:07 10:58:08.................................................................................&...(.......................................H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................o...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..RI%..$.IJI$.$.BxN..j......Q...&...C.1j6...+.....THF..$.&Ej.I$...I%?...RI%..$..&~I)p....h..........D..&.V.E".....HV....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\img\loading.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 420 x 18, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1909
                                                                                                                                                                                      Entropy (8bit):7.234982063350527
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:PCCRgnxwhC+1SOLzA5+MTFC+M/BA6AlIxrYzI:KoyS8Og5rTA+BlCrYU
                                                                                                                                                                                      MD5:9DA3F1D059FECE8DDB1F6EDF43AC2363
                                                                                                                                                                                      SHA1:DB62DC742686C128F461938287DA27E4C522B1BF
                                                                                                                                                                                      SHA-256:E923BC0678176F9847AAFF4AC59E9F7C39780469BA29F6BAA481BA99312EF7AC
                                                                                                                                                                                      SHA-512:AA0DD1E1677D37386FD998676747D445D62DA8DF8A05B01A62FA5FE8D895EB428C473499C043957497AE7CAB63D6524A93B18ABDB900813355DD13D484BFC6F2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............#vZ.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEp.....t..............l..|..c..L..Z.....R..E..J..z..i..G..r..`....Q...S..Y..V..O..T..d.....M....ou.._..f..a.....G..{..{.....b........L..H..b..R..M..N..W..S..p..Z..l..t.......aZ..a..Q.....X..N..M....#M..s....mk..Y..i.....a..Y.......iZ..k.....r..R..V..s..s..o..Y..s..j.....s..z..S..c....t..X...H.......YS..F..^..I.....S..c..P..T..H..[.....w..R..P..L.....|..K..H..K..M..M..Z....hN.....l..]..R.....Z..R..S..S.....L..../Z..m..r..s..I....qL..N..a..Y....6R..r..Z....+{.....W..j....{O..l..^..`..|..g..M..j....JK.....W..v..t..d..O..J.......E...)i.h.._..L..p..J.....t..$j.`..b..f..L..^..e.v..6-p.[..a..:w.F.4a..,r.'n...26}.>.m$k......g~..]..6|.@.o..QR.3j..J....Zd..U.1%l.e..k....*2u.F..x..-s.M..G.%.....(...3.lc..'o......=..T..x..3t...t_.....|:F.....tRNS..................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\installflash.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\intalltempapp.html (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):519
                                                                                                                                                                                      Entropy (8bit):5.160278137718593
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgGxC7/mjWsVnqJmxTTqK5eQE8OYMCcfxqc2OAqUKCGb:hPrC1sV8IfvEYMCo9z
                                                                                                                                                                                      MD5:B00593D03F76B157C02A72A9F132405A
                                                                                                                                                                                      SHA1:FCE91F62543C4104BB906F3A83F6DEB7DEC0F5BB
                                                                                                                                                                                      SHA-256:825D1318B7463FD5F670958C5E7BEC7D609340661EAD84ABB4F2E68FF987498B
                                                                                                                                                                                      SHA-512:A33793891F05D7610FAD9D5B6F1EBCB4799871BE6F00C964E1390F36421085DC04DD1AE2C7BBB219FABBAB2FA94EAB2E923B491C81871A06EEA33EB639CBF2C7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..function changeProgress(value){...$(".in").css("width",value+"%");...$(".percent").html(value+"%");..}..</script>..</head>....<body>....<div class="box">...<div class="loading"><div class="in" style="width:0%;"></div></div>...<p class="percent">0%</p>..</div>....</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\apppages\style.css (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1657
                                                                                                                                                                                      Entropy (8bit):5.247663084618733
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZICveGXqPF+9jJ1exEU+vZYNo+g8HVACmFnRlxnMXUbF:WJ1h+/RV++MZMrA9lxnMXaF
                                                                                                                                                                                      MD5:7E0FB59D3AF2D442F44A939362311DD0
                                                                                                                                                                                      SHA1:3F1FD2C2B9DDC773B6972F767BD321F353C6066F
                                                                                                                                                                                      SHA-256:DF9459349CCB55416078BA535A17AE8587BF321049F4D0A5AF460879B62B4699
                                                                                                                                                                                      SHA-512:03D0D5D69C38A7E1F75D39A31E9C597B862F9D1BEDFA14C4CB8FD37EFE5800FF01F97A917A8ABDE8C33E98A87436101D183250D101E5BB85B1686A1F3B3B7935
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...t-a-l{text-align:left;}...t-a-c{text-align:center;}...t-a-r{te

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\commonSoft.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\deskrule.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\desktoptool.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):815976
                                                                                                                                                                                      Entropy (8bit):6.583545883404885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:CHdnaQERSfWMwBsidpIitSeVkud0KWrQF8:QZXPudnWkF8
                                                                                                                                                                                      MD5:5CFAE5D76DED38E1CB816B78D8E66D2C
                                                                                                                                                                                      SHA1:924700D0891FCCA309EF6FBDA1877A82073FC68B
                                                                                                                                                                                      SHA-256:B7F777BF003E3EEFFC846E483FAA6C435AD1266560BEAC4D51A95703AC12D701
                                                                                                                                                                                      SHA-512:DDC75AEA59D9500E7BA8A4E592412752946935B518C90C3D2237422E12AF5790448918C6C938764EDAC39C98A65FD80C6DA7E8C2B4CD8047EB26B775F1476DFB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..eR..eR..eR.U*...eR......eR..7...eR.....eR.....FeR..?..eR..)..eR..eS.`dR.....eR..7...eR......eR.Rich.eR.........................PE..L....x.P.....................H......m>.......0....@.......................................@..................................l..,.... ...............`..h....@..ln...6..................................@............0...............................text...P........................... ..`.rdata...Z...0...\..................@..@.data............:...t..............@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtappcore.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):331440
                                                                                                                                                                                      Entropy (8bit):6.5814193529642795
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:kzs3sd6FY2zMINPNwB7Ki21uEodEsi9x2lEcJAxcvyXAO8+/ylz:Ks3sdsY2PiBFxREsi9x27Wucy
                                                                                                                                                                                      MD5:E2FB918E63CF2E8629227FD873A5A362
                                                                                                                                                                                      SHA1:8CB0D496D8A7FE7359537B6B33FBE521A1DCA32A
                                                                                                                                                                                      SHA-256:44C708835AE7F657AB5C07A465ED9375C810D907D1A17A5C33B31C2482515080
                                                                                                                                                                                      SHA-512:CA91972D7ECD199F23304581D190F86AE9D0196BF7C7307C9F9E4AC84F9BD8D0C13D4BD4E5A1D3DB00F1837B468837789902620C974704B6C07866C23FE7A79D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bk...8...8...8.8...8A..8...8...8...8...8`..8...8...8.8a8...8.8w8...8...8...8...8...8...8...8.8...8...8...8Rich...8........PE..L...qk.Q...........!.........X.......".......................................@......F.....@......................... ...y.......................................-...................................V..@............................................text............................... ..`.rdata..............................@..@.data...<>..........................@....rsrc...............................@..@.reloc...F.......H..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtfilm.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):799920
                                                                                                                                                                                      Entropy (8bit):6.4627860261767065
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:4jM/yrSizUTnIzVWz7PWY9F9Y8yVrpfiFRJyNLcE:AliXJycE
                                                                                                                                                                                      MD5:BE550CCD74044C170270D76FB2B38D2F
                                                                                                                                                                                      SHA1:A87F969DD5F4744323CC3C7B49231E2117CABF7F
                                                                                                                                                                                      SHA-256:1AAC90BF0D24CD4B164BCFFA338B4CFF3102C12769FD0A0777F2B964CFDDC8BA
                                                                                                                                                                                      SHA-512:32C82C00F2097CBC42AB0308B7F35096C99014E9E93710B0FC027CEC0272B086AC745F31CF01490AA6117D4C6A2B215E01B67A942259CA49719A3097AB70854E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`..i.F.i.F.i.Fh&.F.i.F...F.i.F.;.F.i.F...F.i.F...Foi.F.cF.i.F.uF.i.F.i.F.h.F...F.i.F.;.F.i.F...F.i.FRich.i.F........PE..L....ZQ..................................... ....@.......................................@.............................................D......................(....'..............................h...@............ ...............................text............................... ..`.rdata....... ......................@..@.data............V..................@....rsrc....D.......F..................@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):146792
                                                                                                                                                                                      Entropy (8bit):6.652917793404133
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:c8D6ap8rG5eDM8iTbcGiTKiSOufcReWTBf+r5wHvOc:c8ppeG5eP6itSaeWTB3POc
                                                                                                                                                                                      MD5:A0778C2A0DCFF99F83CB63DB2537C0D6
                                                                                                                                                                                      SHA1:253F2B000F046C62D77B48A87A4A99819D647996
                                                                                                                                                                                      SHA-256:5C5BC028291B1940D03036F0D125EDB17BD2E6D3BE66900A16CD98B739507F2C
                                                                                                                                                                                      SHA-512:84B058608B781B3383CCEB9A3FF26602E631CC398FD57C310EF785573F1FF6DA23070957D4554F6FA8526ABC6A6141432E154F186A4AF4D926C36BC5B414F8E6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S)V..H8..H8..H8......H8..0...H8..0..H8..0.. H8.0.U..H8.0.C..H8..H9..H8..0...H8..0...H8......H8..0...H8.Rich.H8.........PE..L......Q...........!.....d................................................................@..........................................@...............*..h....P..\.......................................@...............0............................text....b.......d.................. ..`.rdata...x.......z...h..............@..@.data....>..........................@....rsrc........@......................@..@.reloc...)...P...*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtswitcher64.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):167544
                                                                                                                                                                                      Entropy (8bit):6.3438521480270085
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:QAI9+Gkf+xVpBHO9mNMy4ZFMV2bWqtsRi2TBf7sWr5qJcR2:zI9+GPJNMy4Pw2b+i2TBwWcW2
                                                                                                                                                                                      MD5:F54B6E8B821138CE6110DE7B964E53D8
                                                                                                                                                                                      SHA1:0EEFD010E4C9001B795B8A81FF2B8BDEB854A219
                                                                                                                                                                                      SHA-256:DD983F896F412B264B9D0E2B296C63FFD750B81E1240794B312C967752D89DC0
                                                                                                                                                                                      SHA-512:AC5BD4F315F3FDA20EAA0CAFC371491D936E1389C517B093CD561888FDBB96457A8F1848047F519419B86495BA890C394873CE998E6F5BCBDD746A533BA92C44
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jR.............3.......................................3i......3..........y...................................Rich............PE..d...h..Q.........." ................................................................(.....@..........................................P......x;.......................z..x.......|.......................................................p............................text.............................. ..`.rdata..............................@..@.data...PK...`.......:..............@....pdata...............V..............@..@.rsrc................n..............@..@.reloc..F............t..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtwebbrowser.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):760168
                                                                                                                                                                                      Entropy (8bit):6.41146860850765
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:QZKD6SfHPAf/Xjd8xob+5kcc4cfpcJIU1GhDan4Jz/izR36nYNTYhrW6ZLsvMq:QZQkKxob1cG3U8hDa4JCR3YYNTYhy6m7
                                                                                                                                                                                      MD5:26464985B396AE1DB6A2D6E7B070A3C8
                                                                                                                                                                                      SHA1:D102D7817311F1999D0251A80DFEAC2895E8B0C1
                                                                                                                                                                                      SHA-256:93AEF6CA6FA760D3783EE1157B3E9EAE1F6EE21C3D1BE39D4485DE6DA70F21E7
                                                                                                                                                                                      SHA-512:FA2E8D7B352F05C696916FCF762A47BEFE119FD51148DC525F2AB569E98FC94E97EC1369E4ABDF07151069464DC9839E61C063C0336E6EA16A18F72F7EDDB5B7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1y..P.Z.P.Z.P.Z...Z.P.Z.(.Z.P.Z...Z.P.Z.(.Z.P.Z.(.Z.P.Z..zZ.P.Z..lZ.P.Z.P.Z.Q.Z.(.Z.P.Z...Z.P.Z.(.Z.P.ZRich.P.Z................PE..L......P.................L...6......it.......`....@.................................R8....@.............................................................h....P...w..@g..................................@............`...............................text...kJ.......L.................. ..`.rdata...{...`...|...P..............@..@.data............H..................@....rsrc...............................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\dtwebframe.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):171480
                                                                                                                                                                                      Entropy (8bit):6.44138290249757
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:F4qo0pTzJR9UoHQfxhKQ2ulRCW/ZfGEAkz5GRWGgTo:uYT1X00Q2ulRCWBfVY3gTo
                                                                                                                                                                                      MD5:755FE45383AAA53782A41CA691F700F1
                                                                                                                                                                                      SHA1:405182FD8BD46541018002749DB2185364A2FD2C
                                                                                                                                                                                      SHA-256:1BCA911A9D638D11634F4B1D27AED484163355ABA41E78312EE9DBDB7F062CA7
                                                                                                                                                                                      SHA-512:BAE5191CF2544F8F107944483EA8298A5319E37779A162423A837F1B8E6C203CDD0692AFB9077A895C3BC16F1951C50263164A041EF3CAE69D95E00C978C3E91
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...up..up..up...?..tp..|...dp..|....p..|...Op..R...qp..R...dp..up...p..|...|p..|...tp..k"..tp..|...tp..Richup..........................PE..L.....[Q...........!................"...............................................R.....@.........................`4..~...\$.......................z...#......` ..`...............................0...@............................................text.............................. ..`.rdata...t.......v..................@..@.data...XA...@...$... ..............@....rsrc................D..............@..@.reloc.../.......0...J..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\feedback.ui (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):385200
                                                                                                                                                                                      Entropy (8bit):7.182105590695188
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:MEvvCXZPBZirt5lLK8WqZaWZYlY2hE8XqYR/pURWepSmEU:M6CXdBZirtvxDZNYl44q+paWOSm
                                                                                                                                                                                      MD5:28580334E670277D005E38D4C9E65CFD
                                                                                                                                                                                      SHA1:7EBAF822980EE5DB3A7ADC20C5F266704433210C
                                                                                                                                                                                      SHA-256:E4A42DD9B58F3D7B0A8493B837769C5D32DBF5EDE29A805E3808D4530E410E45
                                                                                                                                                                                      SHA-512:1EF9C47842477F3F7553C5B9CAA30ACC2D1DCA73F3DF86F2E608DA9027B44AAE5B338DF389A7E050B2DF53CF8D20724596411392307F856D6E9CDA90F4F82AB8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................M.).......*......;.......<.@....9.......9...............6.......;.....+.............Rich....................PE..L...3..Q.................*.........._:.......@....@..................................p....@.................................@........................................D..................................@............@...............................text....(.......*.................. ..`.rdata...y...@...z..................@..@.data...............................@....rsrc...............................@..@.reloc..6l.......n...X..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GameBox.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1143104
                                                                                                                                                                                      Entropy (8bit):6.908541805805633
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:M7rMZ9VnpbFmR3Wjih7gK3FNhAuqtqo40gu9xZu9xZoPyL7:8rm9VnphmQihVhAuYqo0u9Xu9XNL7
                                                                                                                                                                                      MD5:8DD4CE4D5EEE031135A64117731F0187
                                                                                                                                                                                      SHA1:139CB0851FDFEF952BC80307F22B9132B941F64E
                                                                                                                                                                                      SHA-256:428A0546DCF68A9ACB6A2CDC6082168652E3D315493230D06C80102BD3D09B1E
                                                                                                                                                                                      SHA-512:1930E581329EEC9B64AE1949AE84563E3F247C7AFF5622ADDB289D1630FB3364BF295CD1D610207D6B5BBB5FCEEC951614AEC9CA8DA4687333BA706D96D9E757
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..6...e...e...e...e...e...e...e...eM..e!X.e...e!X.e...e...e...e...eP..e...e...e...e...eRich...e................PE..L.....Q.....................t....................@.................................e.....@....................................,....P...............R..@....0..........................................@...............(............................text...:........................... ..`.rdata..P...........................@..@.data............<..................@....rsrc........P......................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\360GbApp.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2015408
                                                                                                                                                                                      Entropy (8bit):6.301459019627537
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:fxHf82WTNblrzv1I3pF4HYvMFkzFqv+IFPpds07XTuG+W40oS7B7L9xZY00:fxE9I3H4YCdpz7DuGvoGB7L9XN0
                                                                                                                                                                                      MD5:F20C9B80E5D66E079E4350A1BA0F6295
                                                                                                                                                                                      SHA1:1379EE0823F1B3284611B20F079CC7679C5B4FCE
                                                                                                                                                                                      SHA-256:7764AABF7B2B1756980BEEB384A63106841188DC03A9EDDB79F8F2FE451B8757
                                                                                                                                                                                      SHA-512:8B8608B1B318CF63D86AD4CD66BEACE9A0F294E9F986694B9DEB8C7A3338EFA05F8A0714A9EF6CCAE1384DE0452B29C603421AC00ECB1A489D6EEFC0FB6077B8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V.........w.S......P......A......F.u....~.......~.............A.......O.N.....Q......T....Rich...................PE..L...v2vQ.................t..........R.............@.......................... .......5....@.....................................|....`..Dn..........................................................H#..@...............t............................text....r.......t.................. ..`.rdata...............x..............@..@.data...d........Z..................@....rsrc...Dn...`...p..................@..@.reloc..hK.......L...Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\AppcenterDataGb.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):642920
                                                                                                                                                                                      Entropy (8bit):6.282990832147541
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:5qBB65rJHvhc5gWES4bpbDBCWSul20XW6+MSP95HiVNT3yUO5VZPIxT2AdhWXhlG:7rYUbpnBCWSGP2AWXh5569l
                                                                                                                                                                                      MD5:C9DCDAE63FC4BC3BED7298E7C6FB3D15
                                                                                                                                                                                      SHA1:F573C038E3E005172F475FD4EE805060926BA3CD
                                                                                                                                                                                      SHA-256:468A1EB791002CFC420EBF42DF8D9F07DD345B630584D30A74305EA0F0F62329
                                                                                                                                                                                      SHA-512:2AC67254AFB1F12C8723FC031B95E73F8F07F15E2781CDFBDB03EB0C5D78CEEA47A52AD8864E3B7A488E96EC13B926F20265CB811F04F6F51A45E9E9A1E1A060
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..S..S..t...R..M.n.V...|.R..Z...I..Z.i....Z.n....t...\..S.....Z.`.~..Z.x.R..M.~.R..Z.{.R..RichS..................PE..L.....%Q...........!.....H...p..............`............................... ......-.....@.........................`........t..x.......................h.......tT...b......................H...........@............`..l............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...8U.......4...p..............@....tls....I...........................@....rsrc................B..............@..@.reloc..Ds.......t...H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GBACCore_DefaultSkin.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GBDefaultSkin.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBox.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156848
                                                                                                                                                                                      Entropy (8bit):6.538614114866669
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:2c7Qonv+JBCrms558lMUVnUWxYAJ/Rtrpt2sytOSigKPiSj2eMsRw8e6ciPyyp5B:2G8Crms/8FnPBT7gxShAmwA5cgTx+
                                                                                                                                                                                      MD5:46D0C5A9F1DFAFB0B842BCB2A944B1C5
                                                                                                                                                                                      SHA1:233B8E2769625DD09A576035189D4CA3327E02A6
                                                                                                                                                                                      SHA-256:BF84D8270CC9C4100D8DD52CFF5DEDD30CEDFF723BE38929FA32400BE5D97D8D
                                                                                                                                                                                      SHA-512:E5026A954F575D4FB24109CAC306AC1D848EA62B16475CDC450D3CEFB4B93E1BC45559E99059F927FC2ADBCE7F95EA11BE2A45A7CCA2894C5AA6310F7355D855
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.&...u...u...u.yVu...u.y@u,..u.yGu...u..u...u..u...u...up..u.yIu...u.yQu...u.SWu...u.yRu...uRich...u................PE..L.....RQ...........!................................................................x+....@.............................I............`...............J.......p..4...................................p...@...............,............................text............................... ..`.rdata..YF.......H..................@..@.data...H?... ......................@....rsrc........`......................@..@.reloc...&...p...(..."..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\gamebox\GameBoxCore.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1124528
                                                                                                                                                                                      Entropy (8bit):6.484809189310972
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:Dp6e4S9JuvOCZLmvTO33iFnzQkOMnNf1bt:8S2OOGOMNf1bt
                                                                                                                                                                                      MD5:5619853A5AC4F54323F54A949160EA52
                                                                                                                                                                                      SHA1:60D787F954C12A23AB17DDED9F91C6C4B0B22173
                                                                                                                                                                                      SHA-256:937EC6B0A8D5EFCA5E35F09A11BB6BDDA44FB4EFB9E0CBB9899BF67287820F3A
                                                                                                                                                                                      SHA-512:1607C6A9614F5D5809BBDBA801E9BD2111977AEAE2114B35FA3110E662ED158AA107D6B2732579F7F34D26424D9C52B3800F0A045787F84363B13C8787B6A876
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j...8?..j..e%-..j.......j....8.ej....?..j......j.......j...j..Ok....1..j....)..j...8/..j....*..j..Rich.j..........................PE..L...$PUQ...........!.....l...........................................................Y....@.............................t...4........p............................................................. e..@............................................text....j.......l.................. ..`.rdata...+.......,...p..............@..@.data...\........v..................@....rsrc........p......................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\img_reader.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):203608
                                                                                                                                                                                      Entropy (8bit):6.832543174324689
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:CxIYp86FpmNh/ZBypa4ZunTBfHFy6Ag0Fug795fz8:e86As2nTBvFy6AOIvo
                                                                                                                                                                                      MD5:D3A9CA700C1C65D6DF7E010B0CB0E3F4
                                                                                                                                                                                      SHA1:8E35CFC937B783808DA98376B5ED6163BD77148A
                                                                                                                                                                                      SHA-256:CC4D278AB85A0CEF68EF29FDBF723830C4F2BCC78B5B315F1530674059BCF0CE
                                                                                                                                                                                      SHA-512:8102BFEC316B89BF100350607491942332E881AA80981AEAEF8F607CAD5A4661B8E07BD9FE74506D8D775A56FACE181CF342074668338D42A3250A041AED4269
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...............u{...................uj.....um.0....u|......_z......u......Rich............PE..L....HdN...........!.................6....... ...............................P......x0..............................P...K.......<.... ..................X....0..........................................@............ ..,............................text............................... ..`.rdata....... ......................@..@.data....3..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\oauthlogin.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):343680
                                                                                                                                                                                      Entropy (8bit):6.438296507662578
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:Od5qu1VG/cPM45zTHtcpBBzCXkLDLdfewus5qdr2ZdS1ltQp6:Odgu1VG/cPM4uBzCXkPLkwuwiu6
                                                                                                                                                                                      MD5:A1ECB29EC8237F21ABD334830573EC34
                                                                                                                                                                                      SHA1:DAD2D8F5976A018F3A5FE95C7DA5D8744971D5F8
                                                                                                                                                                                      SHA-256:AB07B5413EB43D56151EA1B072945A3FC0C075BF108AE9977EDB46B7D102E9E9
                                                                                                                                                                                      SHA-512:EABF128304CAB9540556984C43EFCA678897CA9DA07D5949C698156A6C38E8A23D037E98B7138D1930C33403185BDAACC842C79EFBA20FBEBB1379C437A2DEEB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tF..'F..'F..'O.3'W..'O.%'+..'aV.'A..'aV.'I..'F..'...'O."'|..'X.2'G..'O.7'G..'RichF..'................PE..L....NuP.....................t....................@..........................`.......>....@................................. m...........\...........(.......0...+...................................<..@...............|............................text...Q........................... ..`.rdata..J...........................@..@.data....E.......(...t..............@....rsrc....\.......^..................@..@.reloc..B,...0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\processinfo.dat (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\ACCore_DefaultSkin.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\BoxUI.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\DefaultSkin.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\ExtDefaultSkin.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\RSD.UIZ (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_Main_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\focus_rect.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_hover.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\switchtab_press.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\tab_select.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\titlebarbkgnd.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_cloud_button.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_fence1_button.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_fence_button.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_shutdown_button.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\images\topbar\topbar_wallpaper_button.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\msgboxdefault.uiz (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_cm.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_disney.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\softdt.dat (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\softsignore.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Bin\weather.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\config.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\defaultskin\MiniUI.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\defaultskin\Skin.jpg (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\defaultskin\defaultskin.ui (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\360Desktop.setup

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2818
                                                                                                                                                                                      Entropy (8bit):3.8559297372687213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+sO0rEMpNgwp2QaXlUrMlUC4PvNL2mrErXflzlfotMEyEd1GMZZBBCtGcsZBBCF:9KgwTaXjKWXfp9OMBTMZZCIcsZC4kZCw
                                                                                                                                                                                      MD5:00F3065E2E29E877451434AA09D22208
                                                                                                                                                                                      SHA1:8E2B2D93EF47F4B2B3E9F832981791A909C45C7F
                                                                                                                                                                                      SHA-256:44CE1F2F7F9151376E3FC61E55C1307244ABA0124CF39FE184DECE73F2D7504A
                                                                                                                                                                                      SHA-512:8C31B6262C3CF6F0D7A5288AEA358B0D7866F9E93BAD35AB2CF7AD0A0BB6AD908F03E6AB526A1268AD7803B9A75ADE3DB5D8DCED56920FEB5D3D4484F277EABA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.>..... . .<.M.a.i.n. .N.a.m.e.=.".3.6.0..[hQLhb.". .P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .E.x.e.c.u.t.a.b.l.e.=.".s.e.t.u.p...e.x.e.". .T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%..[.". .U.n.i.n.s.t.a.l.l.T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%.xS}.". .M.i.n.i.m.i.z.e.S.p.a.c.e.=.".2.0.0.". .R.e.b.o.o.t.F.l.a.g.N.a.m.e.=.".{.0.9.5.4.A.A.0.5.-.5.D.7.1.-.4.3.4.a.-.8.0.A.6.-.1.0.A.1.A.F.4.1.F.5.C.C.}.". .M.u.t.e.x.N.a.m.e.=.".3.6.0.D.t.I.n.s.t.a.l.l.e.r."./.>..... . .<.A.p.p.l.i.c.a.t.i.o.n. .M.a.i.n.A.p.p.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.". .V.e.r.s.i.o.n.B.a.s.e.F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e."./.>..... . .<.R.e.g.A.p.p.P.a.t.h. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p. .P.a.t.h.s.\.3.6.0.D.e.s.k.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\Plugin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3902
                                                                                                                                                                                      Entropy (8bit):3.5557288835319474
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+JVZlplUZlplfZlplEZlpljotElpl9ZlpljvZlpl9Zlplyn5ibEn5+vEnvlmpgS:dmfGp11p1FAfpE1otR3omfGpWA
                                                                                                                                                                                      MD5:2DD2E9A30A526F127ED55D471E414368
                                                                                                                                                                                      SHA1:80EE609ADD556B87E95BBF1C77ADFD0FE2DB05AD
                                                                                                                                                                                      SHA-256:FF9B5847CBCDB3E9DF84505057E7CD36317308944526EDA5A042C3C81492CCE1
                                                                                                                                                                                      SHA-512:CF85057B916932FE0CD7CB2FE0A183873C41868CD6EA72F13C7AB2058E37F29EA358ABC43B11D2BF9E086047970D43D2B974D8951D9D37BD24F10BEE041E0F1E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.P.l.u.g.i.n.>..... . .<.B.e.f.o.r.e.S.e.t.u.p.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".3.2.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t.6.4...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".6.4.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.M.W.e.b.P.r.o.x.y.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p.M.e.n.u...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>..... . .<./.B.e.f.o.r.e.S.e.t.u.p.>..... . .<.A.f.t.e.r.S.e.t.u.p.>..... . . . .<.I.t.e.m. .T.y.p.e.=.".S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\Register.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2256
                                                                                                                                                                                      Entropy (8bit):3.5953053564026893
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y++V47t7uJWg3oMDgVir4pMQaRkqcPsAwY:63qwvY
                                                                                                                                                                                      MD5:35AA95AC9AC71D0FAD5E19C511FFFD2A
                                                                                                                                                                                      SHA1:ADEEA5639F4C9558C44E73188CBD24C207FA7012
                                                                                                                                                                                      SHA-256:7F9E467EF207FFB4F524C93AF58FE5E9718FF2F0BB2A7B8359FE44AAC1DE509D
                                                                                                                                                                                      SHA-512:9ACCC1BDDDF6B4AA4DE212439D415A04A3BCA96F1F21B90A8CA9D65C88177DF91EE001DC940A57B61A5DAA9B70EAAD86BA76712780DCCE31376CB6580EE9DB98
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.e.g.i.s.t.e.r.>..... . .<.I.n.s.t.a.l.l.>..... . . . .<.!.-.-.>.......<.K.e.y.I.n.f.o. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.3.6.0.D.e.s.k.t.o.p.\.s.a.f.e.m.o.n.". .>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".E.x.e.c.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".S.i.t.e.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".I.E.P.r.o.t.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".3.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".M.o.n.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".U.D.i.s.k.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".D.r.v.F.W.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... .

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\UninstallRootDirFileList.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2330
                                                                                                                                                                                      Entropy (8bit):3.4422158512260266
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+hUlzbb23QmSt2n16n1MHssRJlACXApDXeXyVBVaY636BhNvVPc:WUUu1i1NerACXAleXsBpb6
                                                                                                                                                                                      MD5:55EA164B6BB418440F4659D7AFDE63EA
                                                                                                                                                                                      SHA1:A54EF67DA77A369803FA4DBDFC3FE82A3864B622
                                                                                                                                                                                      SHA-256:991B63FF2711AF2A635C9FC01FC296BC0A30B0ACA3CB0778E798349449F4CAF9
                                                                                                                                                                                      SHA-512:68378479009533964F60AD7E3E515ABF573FB2E306231B9C3E867FC3B663A50DBE8A6DC7C0B1FB3453B7B69C9C52C50345F1719EE0CEF63C31BCC40E548FB1BB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.D.i.r.F.i.l.e.s.>..... . .<.D.i.r.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".B.i.n.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".C.o.n.f.i.g.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".s.a.f.e.m.o.n.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".b.a.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".L.i.v.e.U.p.d.a.t.e.L.o.g.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".u.p.d.a.t.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".D.T.F.e.n.c.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".l.o.g.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".m.o.d.u.l.e.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.C.a.c.h.e.". ./.>..... . .<./.D.i.r.>..... . .<.F.i.l.e.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".7.z...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". ./.>..... . . . .<.I.t.e.m.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninst\filelist.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):82552
                                                                                                                                                                                      Entropy (8bit):3.7230656395395596
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:15GYKRpRvAERQ3J3HzoE4oltGT8r2rchp+r+8D9NLx:15GtRpR7RQtrHa8r2jFD9NLx
                                                                                                                                                                                      MD5:C9B3EF7097B1EB528A71EAD78B2CEEEB
                                                                                                                                                                                      SHA1:803FC5D048BF9B6370BFCA85ABB0CC80B0701CA2
                                                                                                                                                                                      SHA-256:8DBA5E7360352A2317F34F5C5CB7D712BD417F82D2B11C4C395695B5EAC049F1
                                                                                                                                                                                      SHA-512:9038E006FB468AE4ECCDFBA131A1CB89200D225C5A8B4E4D764EFC279C01BF1ADCBBDB90A8F7065CBAA1BA561D03E892CC2B964E18A8B395BAF2182A4861B1AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.F.i.l.e.L.i.s.t.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".7...3...0...1.0.3.5.". .S.i.z.e.=.".2.7.1.9.6.8.". .M.D.5.=.".2.0.E.6.9.F.7.B.5.5.E.A.4.F.7.A.4.8.7.3.6.A.1.9.3.8.9.B.D.2.F.9."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".2...4...0...1.0.4.1.". .S.i.z.e.=.".4.7.8.0.5.6.". .M.D.5.=.".8.7.0.1.0.9.6.D.5.7.2.C.5.6.D.F.7.C.4.1.F.A.1.9.8.7.B.6.9.6.6.7."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.n.e.t...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...2...0...1.0.4.2.". .S.i.z.e.=.".2.7.5.2.8.8.". .M.D.5.=.".E.6.F.F.7.6.3.A.4.A.C.9.1.2.3.2.9.7.9.5.6.0.5.2.5.E.1.2.E.4.C.3."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.P.2.S.P...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...3...0...1.0.8.0.". .S.i.z.e.=.".7.2.4.6.0.0.". .M.D.5.=.".6.4.0.F.3.3.B.0.0.5.9.E.D.6.E.B.8.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\360Desktop.setup

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2818
                                                                                                                                                                                      Entropy (8bit):3.8559297372687213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+sO0rEMpNgwp2QaXlUrMlUC4PvNL2mrErXflzlfotMEyEd1GMZZBBCtGcsZBBCF:9KgwTaXjKWXfp9OMBTMZZCIcsZC4kZCw
                                                                                                                                                                                      MD5:00F3065E2E29E877451434AA09D22208
                                                                                                                                                                                      SHA1:8E2B2D93EF47F4B2B3E9F832981791A909C45C7F
                                                                                                                                                                                      SHA-256:44CE1F2F7F9151376E3FC61E55C1307244ABA0124CF39FE184DECE73F2D7504A
                                                                                                                                                                                      SHA-512:8C31B6262C3CF6F0D7A5288AEA358B0D7866F9E93BAD35AB2CF7AD0A0BB6AD908F03E6AB526A1268AD7803B9A75ADE3DB5D8DCED56920FEB5D3D4484F277EABA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.>..... . .<.M.a.i.n. .N.a.m.e.=.".3.6.0..[hQLhb.". .P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .E.x.e.c.u.t.a.b.l.e.=.".s.e.t.u.p...e.x.e.". .T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%..[.". .U.n.i.n.s.t.a.l.l.T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%.xS}.". .M.i.n.i.m.i.z.e.S.p.a.c.e.=.".2.0.0.". .R.e.b.o.o.t.F.l.a.g.N.a.m.e.=.".{.0.9.5.4.A.A.0.5.-.5.D.7.1.-.4.3.4.a.-.8.0.A.6.-.1.0.A.1.A.F.4.1.F.5.C.C.}.". .M.u.t.e.x.N.a.m.e.=.".3.6.0.D.t.I.n.s.t.a.l.l.e.r."./.>..... . .<.A.p.p.l.i.c.a.t.i.o.n. .M.a.i.n.A.p.p.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.". .V.e.r.s.i.o.n.B.a.s.e.F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e."./.>..... . .<.R.e.g.A.p.p.P.a.t.h. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p. .P.a.t.h.s.\.3.6.0.D.e.s.k.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\Plugin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3902
                                                                                                                                                                                      Entropy (8bit):3.5557288835319474
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+JVZlplUZlplfZlplEZlpljotElpl9ZlpljvZlpl9Zlplyn5ibEn5+vEnvlmpgS:dmfGp11p1FAfpE1otR3omfGpWA
                                                                                                                                                                                      MD5:2DD2E9A30A526F127ED55D471E414368
                                                                                                                                                                                      SHA1:80EE609ADD556B87E95BBF1C77ADFD0FE2DB05AD
                                                                                                                                                                                      SHA-256:FF9B5847CBCDB3E9DF84505057E7CD36317308944526EDA5A042C3C81492CCE1
                                                                                                                                                                                      SHA-512:CF85057B916932FE0CD7CB2FE0A183873C41868CD6EA72F13C7AB2058E37F29EA358ABC43B11D2BF9E086047970D43D2B974D8951D9D37BD24F10BEE041E0F1E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.P.l.u.g.i.n.>..... . .<.B.e.f.o.r.e.S.e.t.u.p.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".3.2.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t.6.4...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".6.4.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.M.W.e.b.P.r.o.x.y.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p.M.e.n.u...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>..... . .<./.B.e.f.o.r.e.S.e.t.u.p.>..... . .<.A.f.t.e.r.S.e.t.u.p.>..... . . . .<.I.t.e.m. .T.y.p.e.=.".S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\Register.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2256
                                                                                                                                                                                      Entropy (8bit):3.5953053564026893
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y++V47t7uJWg3oMDgVir4pMQaRkqcPsAwY:63qwvY
                                                                                                                                                                                      MD5:35AA95AC9AC71D0FAD5E19C511FFFD2A
                                                                                                                                                                                      SHA1:ADEEA5639F4C9558C44E73188CBD24C207FA7012
                                                                                                                                                                                      SHA-256:7F9E467EF207FFB4F524C93AF58FE5E9718FF2F0BB2A7B8359FE44AAC1DE509D
                                                                                                                                                                                      SHA-512:9ACCC1BDDDF6B4AA4DE212439D415A04A3BCA96F1F21B90A8CA9D65C88177DF91EE001DC940A57B61A5DAA9B70EAAD86BA76712780DCCE31376CB6580EE9DB98
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.e.g.i.s.t.e.r.>..... . .<.I.n.s.t.a.l.l.>..... . . . .<.!.-.-.>.......<.K.e.y.I.n.f.o. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.3.6.0.D.e.s.k.t.o.p.\.s.a.f.e.m.o.n.". .>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".E.x.e.c.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".S.i.t.e.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".I.E.P.r.o.t.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".3.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".M.o.n.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".U.D.i.s.k.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".D.r.v.F.W.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... .

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\UninstallRootDirFileList.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2330
                                                                                                                                                                                      Entropy (8bit):3.4422158512260266
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+hUlzbb23QmSt2n16n1MHssRJlACXApDXeXyVBVaY636BhNvVPc:WUUu1i1NerACXAleXsBpb6
                                                                                                                                                                                      MD5:55EA164B6BB418440F4659D7AFDE63EA
                                                                                                                                                                                      SHA1:A54EF67DA77A369803FA4DBDFC3FE82A3864B622
                                                                                                                                                                                      SHA-256:991B63FF2711AF2A635C9FC01FC296BC0A30B0ACA3CB0778E798349449F4CAF9
                                                                                                                                                                                      SHA-512:68378479009533964F60AD7E3E515ABF573FB2E306231B9C3E867FC3B663A50DBE8A6DC7C0B1FB3453B7B69C9C52C50345F1719EE0CEF63C31BCC40E548FB1BB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.D.i.r.F.i.l.e.s.>..... . .<.D.i.r.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".B.i.n.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".C.o.n.f.i.g.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".s.a.f.e.m.o.n.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".b.a.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".L.i.v.e.U.p.d.a.t.e.L.o.g.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".u.p.d.a.t.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".D.T.F.e.n.c.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".l.o.g.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".m.o.d.u.l.e.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.C.a.c.h.e.". ./.>..... . .<./.D.i.r.>..... . .<.F.i.l.e.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".7.z...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". ./.>..... . . . .<.I.t.e.m.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Config\uninstbackup\filelist.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):82552
                                                                                                                                                                                      Entropy (8bit):3.7230656395395596
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:15GYKRpRvAERQ3J3HzoE4oltGT8r2rchp+r+8D9NLx:15GtRpR7RQtrHa8r2jFD9NLx
                                                                                                                                                                                      MD5:C9B3EF7097B1EB528A71EAD78B2CEEEB
                                                                                                                                                                                      SHA1:803FC5D048BF9B6370BFCA85ABB0CC80B0701CA2
                                                                                                                                                                                      SHA-256:8DBA5E7360352A2317F34F5C5CB7D712BD417F82D2B11C4C395695B5EAC049F1
                                                                                                                                                                                      SHA-512:9038E006FB468AE4ECCDFBA131A1CB89200D225C5A8B4E4D764EFC279C01BF1ADCBBDB90A8F7065CBAA1BA561D03E892CC2B964E18A8B395BAF2182A4861B1AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.F.i.l.e.L.i.s.t.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".7...3...0...1.0.3.5.". .S.i.z.e.=.".2.7.1.9.6.8.". .M.D.5.=.".2.0.E.6.9.F.7.B.5.5.E.A.4.F.7.A.4.8.7.3.6.A.1.9.3.8.9.B.D.2.F.9."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".2...4...0...1.0.4.1.". .S.i.z.e.=.".4.7.8.0.5.6.". .M.D.5.=.".8.7.0.1.0.9.6.D.5.7.2.C.5.6.D.F.7.C.4.1.F.A.1.9.8.7.B.6.9.6.6.7."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.n.e.t...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...2...0...1.0.4.2.". .S.i.z.e.=.".2.7.5.2.8.8.". .M.D.5.=.".E.6.F.F.7.6.3.A.4.A.C.9.1.2.3.2.9.7.9.5.6.0.5.2.5.E.1.2.E.4.C.3."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.P.2.S.P...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...3...0...1.0.8.0.". .S.i.z.e.=.".7.2.4.6.0.0.". .M.D.5.=.".6.4.0.F.3.3.B.0.0.5.9.E.D.6.E.B.8.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\DumpReport.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):216704
                                                                                                                                                                                      Entropy (8bit):6.532910128712557
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:l6VgjYzDal0nZySd3cZeC8PLErN1wuLydldZG649oL7xG4KKLylg5KMit8GC:kGczDu0kSdMeXLErN1wuLAlY9GdG/zbC
                                                                                                                                                                                      MD5:E2CF8C3384795D23631D1A1B86E33FDF
                                                                                                                                                                                      SHA1:FE160C83C7BB1EA2C8D4494C7BF91474B47CA5D8
                                                                                                                                                                                      SHA-256:319227E2202B3B72CE20107A5FD05B90E89A69492D9F5DBACA3EDA95D2C86AD3
                                                                                                                                                                                      SHA-512:AC579907580185D7809736AF2037623DFFED5F83B8FE0474238233EFE20F3001176D5007F0360F281E6D1DCC1EA74146681E642FBDF48228227ECD7998AFB822
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..q:..":..":.."...";.."3.."#.."3.."...".x.";..".x."-..":.."..".."1.."3.."w.."$..";.."3..";.."Rich:.."........................PE..L....q.P.................f........................@.........................................................................$........`...............8...............................................................................................text...ld.......f.................. ..`.rdata...~...........j..............@..@.data....P.......2..................@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\LiveUpd360.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):399344
                                                                                                                                                                                      Entropy (8bit):6.525659947793564
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Q60nOaN+UpBOp+j1stF+sb6YkgXti5Y2ch+:QJ06fIQ5Y2S+
                                                                                                                                                                                      MD5:77106684F45C7C504B21AD948956734E
                                                                                                                                                                                      SHA1:5043039A8BC35EE71D8F17B921F35D6DEBF01831
                                                                                                                                                                                      SHA-256:F3803AB55BBFFFECA21BAB8BED43004A0DD019B1A97196602825E1D1D61C9554
                                                                                                                                                                                      SHA-512:4DC02E47B6071395D7CDA332CE74109F92682C7A00346C3DC0160D9747881D78A93F38B20A7C4CEB1B5E25B1E6CC86D3AAC98780AE40F3378C4DE007CA951C9D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qW. 56.s56.s56.s...s46.s.y.s46.s<N.s)6.s<N.s.6.s...s"6.s56.s.6.s<N.sU6.s<N.s46.s+d.s46.s<N.s46.sRich56.s................PE..L....q.P...........!.........>.......+...............................................l................................../............@.......................P..|....................................U..@...............0............................text.............................. ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@.reloc..@D...P...F..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\LiveUpdate360.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):811656
                                                                                                                                                                                      Entropy (8bit):6.876739267086473
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:FNi+QMNY5S0yQVkt/ozaCcTG8ky/D4CUpkJ8:FiboQWRozU/D4CUpkJ8
                                                                                                                                                                                      MD5:41D9C718B95D971613AE0DD97487A3B0
                                                                                                                                                                                      SHA1:1294F7361FD7CF3B40ADE74E72B1140C9C4CCD4D
                                                                                                                                                                                      SHA-256:DA3AE4C54360E717F727F09152B5BBC91696501BBA4DEB727ECB868D1E66E818
                                                                                                                                                                                      SHA-512:6E9ECDBE00F05CCCBB33013EFAD0661D0EB9FBCCEB1C4BFE24D619C06A34DEC9817BE2E53A925B34BB769700A4020247958C60C11B954E2A24CBD9BC4E635B7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O..@.4..O...77..O...7!.SO.....O.....O...O...N...P...O...7&..O....6..O...73..O..Rich.O..................PE..L....r.P.....................J......UX............@..................................G..........................................@....................L..............0................................................................................text............................... ..`.rdata..............................@..@.data...Xt.......@..................@....rsrc................<..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\MiniUI.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1177688
                                                                                                                                                                                      Entropy (8bit):6.566981597578591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:hmAickpYIlJwnR4F9BMt10HLXZSOzFeCfGCEXkWE2ayCMqM02yEhmAS1SD0YyqTY:n0YIlJwnR4F9BMt10HLXZSOzFeCfGCEM
                                                                                                                                                                                      MD5:4A21ACD5FDB8E006E5CCFB259B557106
                                                                                                                                                                                      SHA1:146CA6B76B8BF54E7C640D46AF353E9F84423972
                                                                                                                                                                                      SHA-256:63360E5CD4806E6711E49878ACE346136AE829AB4EFA6C354753860E9A02BFE9
                                                                                                                                                                                      SHA-512:A4C1023C138FD1E8CBB31E8BCDB65A16EE8D7518A6BE44B127A585DE66F19DD82B43FC4953FD68C276763EBBE6CE5152970A524257218A961A0C862F16BF7E45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...ue.ue.ue..*t.ve.|.w.Te.R...we.R...fe.ue..d.k7f.}e.|.f..e.|.a.sd.|.p.te.k7v.te.|.s.te.Richue.........PE..L...g.vO...........!.........................@...............................0..........................................A..............................X.... ..\....F..............................`...@............@..h...l...@....................text....,.......................... ..`.rdata..1....@.......2..............@..@.data....w.......R..................@....rsrc...............B..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\PDown.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):210408
                                                                                                                                                                                      Entropy (8bit):6.507157820903005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:TJnuJFUvm00JlB8uLp/Me7AQo7ZWQueVMAI64kliFa/nyG5e0P9:9nuJFUvSJP/Bid9/VMg4klfiI9
                                                                                                                                                                                      MD5:23944F2C8C2614814CD9EEEAD7C15622
                                                                                                                                                                                      SHA1:FE5BFBED6900D976AC56EAC386423D82A35BDE7E
                                                                                                                                                                                      SHA-256:68CB47636533713F460FA932975189BEFB0DDCA0750E8F75418B6C616F9BA3BA
                                                                                                                                                                                      SHA-512:C16AC9EB39375950E554CB6C2814ECD385D39F2729DC2B26618647705D99DE7A2626759C3DEEB8C8A12E7658ECE6A5569FB1EF5D01B8F1CB8CFFAD7EEFE92555
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................o.~......}......k.A....K.........h.....l......z......|......y....Rich...........PE..L....q.P...........!.....L...........N.......`...............................`.......3............................................... .......................0..`....c..............................`...@............`...............................text....J.......L.................. ..`.rdata...y...`...z...P..............@..@.data...@<..........................@....rsrc........ ......................@..@.reloc..^*...0...,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\Uninstall.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1146032
                                                                                                                                                                                      Entropy (8bit):7.1292448119285154
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:+jcxTzOiH74zs4urel9BlKfEZzss4Ueh4ffGs6bW2iYjS:+j1CKorel9icZzD4fh4fP6K8S
                                                                                                                                                                                      MD5:B856763537C16C746EDCF36EFC187930
                                                                                                                                                                                      SHA1:E384680D705C4098FF825B2B0F2ADD6FF7C40BA5
                                                                                                                                                                                      SHA-256:585AFCC72620246453007DD33819E85F8B677DC2896C81BBB25F3A8BD05E4F68
                                                                                                                                                                                      SHA-512:4F9A69E2689F4240C569DC3AB7CEB0C5EC094B3D355591F6EE30A3A6B15B7FF11DB2E7FB0038A5011F0615E68DE8D7FCBE2A193A88646EB2D129FD45DD37B133
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7I.OV'.OV'.OV'.....KV'.F...SV'.Q...JV'.F....V'.F...\V'.h.J.KV'.h.\.hV'.OV&..W'.F....V'.Q...NV'.F...NV'.RichOV'.........................PE..L...3w.Q..........................................@..................................-....@..................................>...........7...........b....... ..Dt.................................p...@............................................text...,........................... ..`.rdata..............................@..@.data....i...p...>...H..............@....rsrc....7.......8..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\360Inst.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):894360
                                                                                                                                                                                      Entropy (8bit):6.50736456481616
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:AflY25rYtl8e37Hgtry9Aaf31szCm5sktTWOW:ao5rAtuz31s++TnW
                                                                                                                                                                                      MD5:7F485B9E043A2B95100E34D80F0AB72A
                                                                                                                                                                                      SHA1:6B1AD0635BCA33E1A68ECC0F8945DF34A03B8F6F
                                                                                                                                                                                      SHA-256:21A1ED802E6896AFC13692D4A66E48EF6C1C80C1EF91246703CC5529D3B21FD7
                                                                                                                                                                                      SHA-512:5C900E97606D3177A24C3DECB4338544B4E1CB4D454DF3B91DC6CDD6BF2B68725A587B0237101674447B813D689942481F83918F5378AB21B76449DACA330717
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........WW".69q.69q.69q&)3q.69q.*5q.69qM*7q.69q.)3q.69q.)2q.69q.)=q.69q..3q.69q..2q.69qM>fq.69q.>dq.69qM>dq.69q4. q.69q.68q"79q.9dq.69q..2q.69q.0?q.69qRich.69q................PE..L......M..........................................@.................................m...............................................@..............@...X............................................................................................text............................... ..`.rdata..............................@..@.data....=..........................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):256872
                                                                                                                                                                                      Entropy (8bit):6.339631168221611
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:3Xb99IZWz+PsND5nraXUrKronKAQLU/3PnXWvobxuaL5RVapOnTgVAO:HTVC0YUzKAQLE/nXR4pnAO
                                                                                                                                                                                      MD5:DEC58427DAFCCF050DA9AC893E28407C
                                                                                                                                                                                      SHA1:402F223A05C6CA83E961DCDA7FAEB7EDE7A37AF5
                                                                                                                                                                                      SHA-256:F007E20E10ACC6BC15A5890961BC9D971D43BC004E685C6B32F7A2261C20A7EB
                                                                                                                                                                                      SHA-512:DAB9B0CF62E65B48FFB018DD37867ED02650F0ADC1800110845030404C421BDBFC58FC2711C306963FC5FBDFFE29E4B99F38F277E8CC601FF9267848FD9A5951
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o.f.o.f.o.f.H=..n.f.f..x.f.f..S.f.f....f.H=..|.f.o.g...f.f..k.f.q..n.f.f...n.f.Richo.f.........PE..L......Q.................h...l.......#............@..........................@............@..........................................@..`...............h........... ...................................@............................................text...1g.......h.................. ..`.rdata...b.......d...l..............@..@.data...|@..........................@....rsrc...`....@......................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1746672
                                                                                                                                                                                      Entropy (8bit):7.994118615758001
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:49152:qQQgSWLXONX2QQIxDZcn/tAFKtJcMEhnmAr5ZS2VfP:qcverZ4BXcBm83S2VX
                                                                                                                                                                                      MD5:02C91D3BE856789E1711C37649F382CC
                                                                                                                                                                                      SHA1:6FE184CE5D2198CBB6CCFF37BCDE5F9950BF9ECE
                                                                                                                                                                                      SHA-256:26286D2C63A0DF39CDDEB780B626D807C92A0B071D9C313010F24692BD98E2A1
                                                                                                                                                                                      SHA-512:A2279790AC31A0DC625CE0390EA2F33C8AD1ED125F2862A46117EF94830FAB66A92D76B8F49F6B8284DB9F306E2F9B4835A728BE381FF6FE126D52228D02AA0E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................P......&/.......................................s...........G..........@................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....G.......H...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1412584
                                                                                                                                                                                      Entropy (8bit):7.990098245004688
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:24576:XbduHjw+g0xZXPga+rRrh0C1hgptkWgq9UHluMqs5/JsB23egfPti:XbdGw+guZ7+xhrhEFgquHz/k2Ogf
                                                                                                                                                                                      MD5:32DC2FA6DB8B8809B12A8CAD215C69FD
                                                                                                                                                                                      SHA1:0C6232CDEE1976179AF0C0CD9CF7E7A07D1F4C42
                                                                                                                                                                                      SHA-256:1FE187BEE814736553B90DED2581060F2AC5A81950876CD9418CF352DD236FE9
                                                                                                                                                                                      SHA-512:10B9467BEB0D71C41BBD487CAA6714CBFE519CA767792E029D39CECEBD660CE16E4DB6833BFD8370EC5628CF83BEB6E5E31C5966997D192895C7485A335C9C4A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................0...............................................s...........E..........8s...............................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....E.......F...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\modules\SwitchBarCloud.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):494
                                                                                                                                                                                      Entropy (8bit):5.057595445515239
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/WgsZLr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/K/Xe/JEm
                                                                                                                                                                                      MD5:5A3EE026FF55F8DD65A26FBC186FD5DB
                                                                                                                                                                                      SHA1:EEF2D54C1A38091E8D61F9BF5B9F4715946D6EC2
                                                                                                                                                                                      SHA-256:86EC857FD7844036CABE640AB49F92784C9225463413FFE1B406F2FB80772372
                                                                                                                                                                                      SHA-512:376E27A5D2DCC391A5C85A51518BBFE2559B72107AB05D0068E04928247688887D56FBED60A19429001B4FC870FF5C6F8914464277E1EA6AFAD63DC3F83F3359
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1003" Enable="1" Visible="1" Image="topbar_cloud_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0009AFAC-C116-4489-A708-6D8479C0D964}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{0121D40F-F397-4f93-919F-664E6577B7D2}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{1FBFB117-BAB2-4924-9510-45185771B0CB}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{5417CDE1-447A-4c7d-B72C-FDB1BF1B74AC}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{7F03A5C8-F93E-4bff-AB98-82E9C3D500C3}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{D8E0D3A9-29EE-4f5a-B3B8-07839C8FD6B2}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{E7E42AB4-0C12-418e-8A42-2401D57D3128}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Common.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):271968
                                                                                                                                                                                      Entropy (8bit):2.7198331920728727
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:xVepfNLvvRB47p+UMXDcOKXYumQN+o5kJAIcPXXvHsnRAvwwCaq:xVahBoMzcOnZ3e0AIcf0nRA9q
                                                                                                                                                                                      MD5:20E69F7B55EA4F7A48736A19389BD2F9
                                                                                                                                                                                      SHA1:B104DD43F009AF3AB490C79CA3FCD5BDB7585965
                                                                                                                                                                                      SHA-256:6C608C5C17969CBFBD43051E860BBA4B9AEDDEDFE57A7310DA37024BA688CBBD
                                                                                                                                                                                      SHA-512:36627BD215C2AFFD4DEC5E3FFAD5CFB7B44AE7FB2FBA4C582867AB248F88FFD50D1537CA86810CA107CF2A672E8016BF34B71C35EBD396C6A2C48AE66FFDABE1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N...............q.......T.......<.......e.......e..............<.......e...................................<.......................Rich............PE..L...9..N...........!.........0......'........................................0..........................................=...H...........................`...............................................................t............................text...b........................... ..`.rdata........... ..................@..@.data....;... ... ... ..............@...history......`.......@..............@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360P2SP.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):724600
                                                                                                                                                                                      Entropy (8bit):6.515371619339392
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xnFslNsHuR4pg6uEBj/jRK5nYg2DNfMC+zFXTX94/wo9Tm5KO1f:5FslNsO6yft2JfMjzFXTt4V9To1f
                                                                                                                                                                                      MD5:640F33B0059ED6EB89AA5133263846D3
                                                                                                                                                                                      SHA1:F1BC1491BBF6DAEC1FB2B1AA3437BBA4C3D3D0BA
                                                                                                                                                                                      SHA-256:677C9F6A9DF66F0F086931AD46B28B4C94BFF7A28960B8E9970B84801D633AD8
                                                                                                                                                                                      SHA-512:14E3A419C0A75B3780903889A0D4921AB7487ECF53272C10042DB4D211D15C226A10CF8C25AA23E143EBFE77C15A7A9D6FAE3BD2F4EAA5A701295A8AA6405313
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^i..^i..^i..y..._i..v..Vi..@;..[i...&..[i..W...~i..y...Ci..^i..i..W....i..W...*i..W..._i..@;.._i..W..._i..Rich^i..........PE..L......P...........!.....v..........<Y..............................................-.....@.........................pX.......D..,....0..................x....@...S..`................................................................................text...,t.......v.................. ..`.rdata..B............z..............@..@.data...@....`...:...F..............@....rsrc........0......................@..@.reloc...q...@...r..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Preview.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):466599
                                                                                                                                                                                      Entropy (8bit):7.98876995594845
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:l/a/pLLvwlZiSJR14i6xYuO16gJl2Liqw1:l/axfvwvr4ifuO1LVqw1
                                                                                                                                                                                      MD5:FA257A25DC911387B7A39163D2292458
                                                                                                                                                                                      SHA1:DF99274CC45698198EB77A173BB351DB781BFE3B
                                                                                                                                                                                      SHA-256:B1F1AD9E4CDBB220591FA3696A5B599D2A7839A57BDF94A16D978FA6ABE2D2CF
                                                                                                                                                                                      SHA-512:8A8074CCA16A6FB49A41FB81BAA481F2AA00FF7AE86C75B798F39748123BE0339AB0BEE212DE855E78737AC3D456A52B8DBC1A3610FCBD2E0603AEBBF2DA166C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........bngB................skin/PK..........)?+.-2c>..c>......skin/bg_02.png.PNG........IHDR.......r.............tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:771404E8442068118F62F9A8ACBC1031" xmpMM:DocumentID="xmp.did:C7F87165D2EC11E09831A55424FFA705" xmpMM:InstanceID="xmp.iid:C7F87164D2EC11E09831A55424FFA705" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C1404E8442068118F62F9A8ACBC1031" stRef:documentID="xmp.did:771404E8442068118F62F9A8ACBC1031"/> </rdf:Description> </rdf:RDF> </x:x

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Preview.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12608
                                                                                                                                                                                      Entropy (8bit):3.5961038555012625
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:fJ/V+o1EjHDQ+MMk8AiCWQmkMAmo1DRQ+MMdyAbcQmkMpyARn+QGkxQOCnrEq:h/ciAHDHvL7X5iDRH4ycXc0n+NLrEq
                                                                                                                                                                                      MD5:EEC1B6937458D1191D797B115011D29F
                                                                                                                                                                                      SHA1:F396D6A26A600D5472B266A73E649A8CA86A03F0
                                                                                                                                                                                      SHA-256:891D9D86D152D550A3FD141B89B5971276045DA7DCEFE856194E53A99814299D
                                                                                                                                                                                      SHA-512:8B3051022462CD2059B4CE491BF7E6A6A807473C1D7F46932DE5E3E03786928FA37336433A778F91027FDC0CB6D1501A3906BE10DEAD37D59A3F6C877F48FE63
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.........<.F.u.n.P.r.e.>..... . .<.P.r.o.g.r.a.m.C.o.n.f.i.g.>..... . .<./.P.r.o.g.r.a.m.C.o.n.f.i.g.>......... . .<.!.-.-. .E.n.t.r.y.T.y.p.e...........N.o.E.n.t.r.y.:. .0...........C.h.a.n.g.e.S.k.i.n.B.u.t.t.o.n.:. .1...........B.u.t.t.o.n.:. .2...........S.t.a.t.i.c.L.i.n.k.:. .3...........U.r.l.L.i.n.k.:. .4.............-.-.>..... . .<.!.-.-. .W.i.n.d.o.w.s. .s.y.t.e.m. .t.y.p.e.........W.i.n.d.o.w.N.T.........W.i.n.d.o.w.9.x.........W.i.n.d.o.w.M.e.........W.i.n.d.o.w.2.0.0.0.........W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.................W.i.n.d.o.w.2.0.0.0.L.a.t.e.r.E.x.........W.i.n.d.o.w.s.V.i.s.t.a.........W.i.n.d.o.w.X.P.........W.i.n.d.o.w.X.P.L.a.t.e.r.........W.i.n.d.o.w.X.P.S.P.2.L.a.t.e.r.................I.E.7.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.L.a.t.e.r.........W.i.n.d.o.w.2.0.0.3.........W.i.n.d.o.w.s.V.i.s.t.a.S.p.1.L.a.t.e.r.................W.i.n.d.o.w.s.7.........W.i.n.d.o.w.s.7.L.a.t.e.r.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360Ver.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):49328
                                                                                                                                                                                      Entropy (8bit):6.422529932487228
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:iCG1hD297LhgEl6n17lNOJG012doMRSX+aeun:7GU7Ngf17nAQRSX+ae
                                                                                                                                                                                      MD5:906222E77961059370D5DAFCAFE6C012
                                                                                                                                                                                      SHA1:69778D3AB991E5BF48C70DFF197ABE31AB45722E
                                                                                                                                                                                      SHA-256:5645C19FE54ED2C736324B89C16E2DE5236EF8162796DD248EF3C89848BE1C4F
                                                                                                                                                                                      SHA-512:DEE872E6A3E70319DBF0D66C67E0645A82176B83C1FB36D3B03F133E2F57A73662031E48F8F882B59ACBD072B7B4702D11122197C2D8C2B2813372D8B108843C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s.......s.....s.....s..z....s...r..s.......s.....s.....s.....s.Rich..s.........PE..L...x8.Q...........!.....d...>......R................................................"....@.............................K.......(................................... ...................................@............................................text...Tc.......d.................. ..`.rdata..[............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360dtpreview.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):478056
                                                                                                                                                                                      Entropy (8bit):6.69121493887301
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:JXTGWxHK5ZdldE/BvlqcmLaMlQnycplieut:LQ5ZdlQqpLaMWyRtt
                                                                                                                                                                                      MD5:8701096D572C56DF7C41FA1987B69667
                                                                                                                                                                                      SHA1:4675615065FE84A53B83FDD87444118592833C22
                                                                                                                                                                                      SHA-256:CEE0805961B49B50E15D51E5EE5709B74F63D91B33B24147A6A328E81CA806CE
                                                                                                                                                                                      SHA-512:B104A0BFD1156450FCD3AC21221D42571045E3C2C52D66E87B33332320627E11F443E1640E1F488A1EE59BC83B0E332E7C998932B56712D45021D0C20F048E39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.)LS.zLS.zLS.z...zMS.zR..zIS.zE+.zUS.zE+.z.S.zk..zFS.zk..zWS.zLS.zsQ.zE+.z.S.zR..zMS.zE+.zMS.zRichLS.z........................PE..L...k~4Q.....................|....................@.................................rI......................................h........`...5...........8..h............................................P..@............... ............................text............................... ..`.rdata..............................@..@.data....s.......6..................@....rsrc....5...`...6..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360net.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):275288
                                                                                                                                                                                      Entropy (8bit):6.682710718683491
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:Xxn20OeU6F/uixt2soJiM3EbmaOCs8WgNeDuctl4dzNQvB2YEGw069uK309tM0Xi:XJRUih2sevZsNeaVzSvBbX6019taPE
                                                                                                                                                                                      MD5:E6FF763A4AC91232979560525E12E4C3
                                                                                                                                                                                      SHA1:366D43F4C049137114FE0D72F84547632A399DD4
                                                                                                                                                                                      SHA-256:250BBC73FECDA4023E52D0D07FB3B77889D4D20BBEA55C59304237F0A1D5F763
                                                                                                                                                                                      SHA-512:2DBD3ACEC39CF7559DD22DF8F2EB2B1B5AE31D65599E3327F7910F375F10A49B7E6AC0A714A1C8D492D33CEFCC8955D5BE6D3AF7BE71B3BA94E54B5AA1437EC9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<.....w.<...G...<...=.y.<......<.......<.......<.......<.Rich..<.........................PE..L...{..O...........!.....f..........;...............................................................................0...z...|........@..h...............X....P..H .................................H...@............................................text....d.......f.................. ..`.rdata...s.......t...j..............@..@.data....6..........................@....rsrc...h....@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\360verify.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Apns.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):246632
                                                                                                                                                                                      Entropy (8bit):6.5486755725416606
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:lUxMO3N5k6yS0ebgKEImqGGtzaIp3Pw8UjpkT7KoXICt7+3ex5rEQwpg:mlk6/0Ajfwt9kfZt79Mg
                                                                                                                                                                                      MD5:6BF5C438B4F13F257E075B4A5B82721C
                                                                                                                                                                                      SHA1:C9827FF84E04C62E326965330193D81115A7B710
                                                                                                                                                                                      SHA-256:D251A672A8DCF9B03896CA462AB40A8AF62E0CB1CCF9333102311BDE8C28333B
                                                                                                                                                                                      SHA-512:7BFA4E47134DB9CA95F6AC6142B9602F216696975925B0BA3E461C35AFFACA20A2CB48F6EA1D85193965226415F4EB3900EBB8D6DA2688FB49920118A563C87F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xy.:<..i<..i<..i..i=..i5`li+..i5`}i...i5`zi@..i..i3..i<..iC..i5`si7..i5`ki=..i"Jmi=..i5`hi=..iRich<..i................PE..L...(*.P...........!................6.....................................................@..........................f..p....\..x.......h...............h........ ..................................."..@............................................text...1........................... ..`.rdata...w.......x..................@..@.data....B...p.......\..............@....rsrc...h............x..............@..@.reloc..D........0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360AppCenter.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1182720
                                                                                                                                                                                      Entropy (8bit):5.878790145137298
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:vQythN900YbDlxdml8TBcLZC58+bm/568r:v+0Wl0LZW8+q/s8r
                                                                                                                                                                                      MD5:DFF6CB443FE4D03F1C1FA454E6BA6777
                                                                                                                                                                                      SHA1:7C133A85C43F2FD4B318B7B3DBF0DAA4E0B784B8
                                                                                                                                                                                      SHA-256:51590C1C13A3356F664BCCFE6F87EC80DC8CC275F2984CBA693D9B01F2DE0057
                                                                                                                                                                                      SHA-512:E2B9267E5A26D0E9B886DBC4B4712899FA9166D3BF1A03359574DC7081A4B4877F65540232E59487ACDF07AEAFC943842E1B573A0684B1CB5F48DFACB4ACE926
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%..D.D.D.2.u..D.<v..D..g..D.<`.!D.<g..D.....D.....D.D..E.<i..D..w..D.<r..D.Rich.D.........................PE..L...^|.P.....................J......M.............@.......................................@.................................|............J.......................\..................................(U..@............................................text.............................. ..`.rdata...4.......6..................@..@.data...<........2..................@....rsrc....J.......L..................@..@.reloc..B............^..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360AppCore.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):158568
                                                                                                                                                                                      Entropy (8bit):6.396896358849047
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:LpgByzIin2++g7LXW9rLhQMuUKavLW1rA239Flao567MWse:LsLFCy9RQMuUKavL78Fqrse
                                                                                                                                                                                      MD5:7A0E3BE308D1900CE4CD241A8948FD67
                                                                                                                                                                                      SHA1:BA925C92F200D39666F91F018CD10D75DA1BFD74
                                                                                                                                                                                      SHA-256:2305E91C09A60FD90C3963C8F95CA7032CC5696D4A122DD5C4798C9BC9343B39
                                                                                                                                                                                      SHA-512:6D4FE7370C41FBBFAFF491207A342D19BBB5DA35F2DC4AACC683B1E6EF2098B4B2DC965E958B92D9154417CD1DED6699B6616F2B557FFAEB5277D347BA435CF9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.uA\.uA\.uAU..AO.uAU..A..uAU..Ae.uA{a.A].uA{a.AK.uA\.tA.uAU..AM.uAB..A].uAU..A].uARich\.uA................PE..L......Q............................z.............@.......................................@..........................................................X..h...........`...............................p...@............................................text............................... ..`.rdata..Da.......b..................@..@.data....R... ...&..................@....rsrc................(..............@..@.reloc..0).......*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTFence.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1088688
                                                                                                                                                                                      Entropy (8bit):6.560009016874765
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:3hQovqIB6QAnhTDxyGkA0FBVYOfT9dHtnTUr8U11zXJ:anh5nOB1fTnNnTUr8U11zXJ
                                                                                                                                                                                      MD5:84070772563D6FF84A462E0ECC089A6A
                                                                                                                                                                                      SHA1:AEFD66A7416B72B4CEAFFB3F734C0CB0DA96E24D
                                                                                                                                                                                      SHA-256:0780014E5076B5AF7B00C5F54B2AF20D451A85CFFFD9C647EB1F24092FEC7453
                                                                                                                                                                                      SHA-512:4C90843363E6A7C6687D03C95EC83BC97D2B6A3F2A13D6DBA0CC8266BAAE82E11DB031D89423A9C32C70B6C5361893BD4B98A754F7CC037C4CA7B453E8A1D7A0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Cr.>...m...m...m.\`m...m.kcm...m .m...m.Arm...m.kum...m.krm[..m .m...m .m...m...mX..m.k|mj..m.kdm...m.Abm...m.kgm...mRich...m................PE..L...DB.Q...........!.....................................................................@.........................P...............P................................................................@............................................text...[........................... ..`.rdata..i...........................@..@.data............:..................@....rsrc.......P......................@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTNotify.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):558536
                                                                                                                                                                                      Entropy (8bit):6.585730875870462
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:2EspBEHRraG0om05h7vV4nkXxWy0gPAb+pCL4q9plyTlFeM6LSfUSm:XKE0TJkicAbiCLxpt6m
                                                                                                                                                                                      MD5:FAF9DFFB6136E079875A3484C28F9719
                                                                                                                                                                                      SHA1:6DEC0F4096B36D2BC47E5C34599EC02407C39A03
                                                                                                                                                                                      SHA-256:437396474FF3AB9B1A6C79ABC8174A8641A9F38400EB1FAE068F2B233533275E
                                                                                                                                                                                      SHA-512:88BA62DDDE2774DF77EF0A4BBB60A2C873AA78EE5EB2B385EFB2289778FAF4B7F98E4E9B9106B06E3074D0EB453F1879835612AD2B6002179BE6C92FDB437D94
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..i-..i-..i-...-..i-...-..i-...-..i-...-..i-...-.i-.c.-..i-.c.-..i-..h-.i-...-..i-...-..i-...-..i-Rich..i-........................PE..L...i..P.................J... ...............`....@.................................G.....@..................................[..........`M...........n.......@...V...e..................................@............`...............................text...@I.......J.................. ..`.rdata..*....`.......N..............@..@.data...<e.......D...d..............@....rsrc...`M.......N..................@..@.reloc...w...@...x..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DTSwitchBar.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):337728
                                                                                                                                                                                      Entropy (8bit):6.542349002922983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:JGOalWTNOn7XCrlxG2XjuwQBiK51uOVowDfwl+s8EkZpGW1eI8N:gvlWBk7XsxG2XjFYiK2rwDfpsdkZgQ8N
                                                                                                                                                                                      MD5:0C6BD516E25819B3970AC08BFC4E714C
                                                                                                                                                                                      SHA1:91326186199377DAD7A7D8673F4B221CFD78DC95
                                                                                                                                                                                      SHA-256:DF2638D240CF56D5AF9130B921D20903837E3DF941B183695D2F9AC59A956A72
                                                                                                                                                                                      SHA-512:95C9E45CEEC10EEF848C81EBB628EC99583F359E0E95AF6BBEC8F9ECB951A350BBA6CD951432995A41025F70FE7C86F90BCE2A0108E19C6ED38DBD5079197031
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.fFn...n...n...g..x...g......g..Q...Ihe.m...Ihs.q...n...'...g..N...g..o...p...o...g..o...Richn...................PE..L......Q...........!.........2..............................................P............@.........................0...L...T...@.......`...............@.......t3..................................h<..@............................................text...c........................... ..`.rdata..|...........................@..@.data....K.......*..................@....rsrc...`...........................@..@.reloc...I.......J..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Desktop.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3760960
                                                                                                                                                                                      Entropy (8bit):6.516553406742661
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:rEEfHBcxvOZtQDR68oBPAaVNhr4OCQsfQr5OEeJPHfXhH3ihdzaHt:t+28w9VNhjoQryJPHfXhXl
                                                                                                                                                                                      MD5:2A73AC6CA39608C3B4E0D857749C4EC9
                                                                                                                                                                                      SHA1:E344442CAA863EF3235DEAA69DA7D0C64E7AA04A
                                                                                                                                                                                      SHA-256:3E42972666B237C4FC16A412E1ACCD7D756AF95E5C05D71CDD07BC6ECBAB6FBB
                                                                                                                                                                                      SHA-512:F5052D7FA191C34BE38AE4DE7E246BAF599504D8BA46DAFBF5D70E01C954011F353AF1BE59199B495C27CB370D390F94BFA85E20012F45678FF361F6169C53CB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................E.0.......3.....@........".......".......%.$....@.......@.........s.....,._.....2.......7.....Rich....................PE..L.....Q.................D+...........&......`+...@..........................p:......a:...@...................................2...... 5.@............D9.@....@7.Dn...y+.....................0./......./.@............`+.H............................text...JB+......D+................. ..`.rdata.......`+......H+.............@..@.data...h.....3.......2.............@....tls....).....5.......3.............@....rsrc...@.... 5.......3.............@..@.reloc..6,...@7.......6.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopAssistant.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):433512
                                                                                                                                                                                      Entropy (8bit):7.139106415773596
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:K+uQsh0TLpB9RHUlRK+/VROuKNomYjemfkUsrBuZ:sQsOTLpB954Rh/f2rmfFs9uZ
                                                                                                                                                                                      MD5:E381639C72EAABDCBCC90BBED1508C03
                                                                                                                                                                                      SHA1:B7DA0993B917596C6DF2B8D7D4A175A00309CFC6
                                                                                                                                                                                      SHA-256:CA7F67FA6BA73843B7E7BA57E2796A0BF807FDA8D0444C27D42D8931E6B81FFB
                                                                                                                                                                                      SHA-512:0A16E8C17EDB0B5E460EEA396AC1A9F43B35161532542389AA4905990AB2DE1A74B8D70ACA167D0145DEF77D6D7353DE723765B204462443448DAA4CD2E7A4F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SL..-...-...-..b!..-...U"..-...U4.-....3..-...U3.^-..0....-..0....-...-...-...U=."-...U%..-....#..-...U&..-..Rich.-..........PE..L...y.,Q...........!.....D...B......H........`......................................ua....@..........................................`...+..............h........-...c..................................@............`..T............................text...@C.......D.................. ..`.rdata.......`.......H..............@..@.data....C.......&..................@....rsrc....+...`...,..................@..@.reloc...H.......J...@..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopMenu.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):123256
                                                                                                                                                                                      Entropy (8bit):6.447135984845218
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:A3LTWXUh0wR0LgAd4FwoX+RFokK95ul77QDtU:AoG7R2gA8woX+RFVKeA6
                                                                                                                                                                                      MD5:E6515A6F40AC15E0089576ADFB8BC2A9
                                                                                                                                                                                      SHA1:57664562863873E14AA890CE1B0473FAB51BAAFF
                                                                                                                                                                                      SHA-256:63F29E4E625FDD68D2AA3E651949CE2DEE027639E2310EE6AF3AC028F328C7DB
                                                                                                                                                                                      SHA-512:E095FF40BC7155D379F6E37AC464A4C33A795B894E78C29062564B3C5307163CFB94ADBCE139FD4AF023532EB7315E7423E7B15201578E584FBBA23F3A4C3AF5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..x3..+3..+3..+:..+ ..+:..+^..+...+1..+...+<..+3..+N..+:..+;..+:..+...+:..+2..+-..+2..+:..+2..+Rich3..+........................PE..L...Za<P...........!.........................@............................... ..............................................tx..........................x...........0B...............................e..@............@...............................text....-.......................... ..`.rdata..+C...@...D...2..............@..@.data....A.......&...v..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopSwitch.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149864
                                                                                                                                                                                      Entropy (8bit):6.805058005152224
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:BjmUXnUXrZWLAV2J9wxQpxSUhEEhMfpp8a55jvmiQ3N7nfRI1C5/:3XUbZ52JGyvhEEYEM43NnfRI1i/
                                                                                                                                                                                      MD5:18E4132F71542139764F16858AD032E0
                                                                                                                                                                                      SHA1:84A4B69504A4E66E550A529D9F994AC503563535
                                                                                                                                                                                      SHA-256:8498007D828D38CC2625A8C0AB9449BDCA5A0C0F430C832F1DA426EAB1960505
                                                                                                                                                                                      SHA-512:8084C631B2A4CCDBC34A663C167001FBC7FD22F2B8FEA72C0255A2E2B8F994B3857DB7DEA90AEE865F15A8155C6B6BF92428A3D344A56EEC9EC0CF2983EF06FD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...........\.......J.......M.....}..............C......]......X....Rich...........PE..L...a..P.................`..........:........p....@.................................^.....@....................................d........Y...........6..h....P..H...Pr..................................@............p...............................text...%_.......`.................. ..`.rdata...C...p...D...d..............@..@.data...</..........................@....rsrc....Y.......Z..................@..@.reloc...!...P..."..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopSwitch64.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):163968
                                                                                                                                                                                      Entropy (8bit):6.612538321745
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:wyYZvF3XAa0y2GIID/eP+gJ8TbUNVPavT+Rvleb0GQ3b25WGVmiQ3N7nfRIitQ:wp61yjZ/O+gZGve9m0Gy1/3NnfRI+Q
                                                                                                                                                                                      MD5:476B86E7D05550919702E25541927DA5
                                                                                                                                                                                      SHA1:682D5B245C419E89C0BC4A4BC5A4D3B2BE901492
                                                                                                                                                                                      SHA-256:F4200B1587639E6F8B64E2CDAC798E60FE64BF26574CA4D78401440B67D9D8EC
                                                                                                                                                                                      SHA-512:BCA25CABE7008EFC174EA6C7B386B733E5098F8AADBE7C1B3B6CCAFF3CDB3E5070FCD0A43F02C6B1AB86BEE1C86A77EF240C0A7FC4A8EF1E3801049D68B4ABD8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................f......p.......a.................u.....o.......q.......t.....Rich....................PE..d......P.........."......x.....................@....................................=.....@.....................................................d....P...Y...0..@....l...............................................................................................text....w.......x.................. ..`.rdata..j_.......`...|..............@..@.data...8;..........................@....pdata..@....0......................@..@.rsrc....Y...P...Z..................@..@.reloc..v............f..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360DesktopUi.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):262832
                                                                                                                                                                                      Entropy (8bit):6.439942220999784
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:EGRs/pNN5FBhx2k7dMboZVw128dPMbPLzvx:EJHpx2k7dMbYVw128pCT
                                                                                                                                                                                      MD5:87D7A4C158C7859A915AF5B5BD4C3CE9
                                                                                                                                                                                      SHA1:199F65BB350933C3584648159CAFE0B845FCBE37
                                                                                                                                                                                      SHA-256:48A8EF3DD7B2F4367129CA765A4DE9A6FFC326978E7B9BB00638AF361882E7AD
                                                                                                                                                                                      SHA-512:C18D8CDBF02846DB60EF34958B77E8D98822011B48A80DC9C26C372DDC77A7E9A31CC91AFD8A4EC8BC3C36F17EBAB5A2520E610BC25B338F230E5F82963D1836
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l.K.....l.......l.....k.l......l..>....l..>....l...m...l.......l.......l......l.......l.Rich..l.........PE..L...#Y.Q...........!.....H..........z-.......`...............................P......S.....@.............................U........... ...............................c..................................@............`...............................text....G.......H.................. ..`.rdata..%b...`...d...L..............@..@.data....C..........................@....rsrc........ ......................@..@.reloc..F8.......:..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Dtsc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [autorun]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):838
                                                                                                                                                                                      Entropy (8bit):5.682484541829824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:ir430vigTB7YbMJeoALLPQCUwLDBa02ATeV/TusJ:OcgTBnVcQLwLo7CWTNJ
                                                                                                                                                                                      MD5:CB2C15C17064829BBEAC4250BCFDBFB1
                                                                                                                                                                                      SHA1:639EC86B1E7C72663664A1439CA3BAFE43F5F64D
                                                                                                                                                                                      SHA-256:8ED8E62D949194EF498A7A93F8530E4992290720E626ACBAE60F3402218BC442
                                                                                                                                                                                      SHA-512:DD4FC5EC4B8A6F8FAB13D88FD75C6A4937C61B08851BCA3D51A6EE69B63ABFAB7A5E08C6DCD616EBAC35EBC047D5E315303106697BA5988C9071DCB86DFDE38F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[recommend]..defaultshow=0. ..shutdownall=0.. ....[autorun]...delayrun=0....[SC]...freeString=0...addMorePic=1....[apns]..load=1..SvrPort=3601..SvrAddr=udp.zhuomian.360.cn ..[search]..default=........18..........[sysmsgapns]..open=1..[sysmsgtest]..open=1....[dtfence]..imagethumb=.jpg|.jpe|.jpeg|.png|.bmp|.gif|.tif|.tiff|.jfif|.dib|.ppt|.pptx|.mp3|.aac|.wav|.wma|.mpeg|.mpg|.dat|.avi|.ra|.rm|.ram|.mov|.asf|.wmv|.rmvb|.flv|.mp4|.3gp|.amv.....[webapp]..default=........default_tip=...............cate_4=........cate_4_tip=................cate_5=........cate_5_tip=..............cate_3=.........cate_3_tip=..................cate_11=.......cate_11_tip=.................[recentopen]..scanext=.doc|.docx|.xls|.xlsx|.ppt|.pptx|.txt|.jpg|.png|.bmp|.psd....[wallpaper]..support_wpsrv=1....[delayapp]..support_delay=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360FeedBack.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):682048
                                                                                                                                                                                      Entropy (8bit):6.167243018513245
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:/1Ol+njQJKsmYfiazL1eh/W9p8RzjTjVIR7H2g1GWHnqfyN8:UlYjQoXlafZ3sTjVc2LQqfyN8
                                                                                                                                                                                      MD5:1990F7E22374AE81A63142C5BC54B006
                                                                                                                                                                                      SHA1:4E4ED0C40FF3F05D76A1D3965B126C0225C61584
                                                                                                                                                                                      SHA-256:9BC7CEA5C5CB8D77E8B07AEA0F6BBD70DFD1F0A0CD01963A4F5C971C67C094AD
                                                                                                                                                                                      SHA-512:BDE8C4F811CB38D4AEFA4A5B4A3D9DC8A865D4330CF5AC9675CE6B3BE94C41D7DF91B76A919FA308C2A7D15968B396BFAEE53BB9845A4A5697AB16B85FA731D8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1&.ouGi<uGi<uGi<,dz<wGi<.[e<tGi<.[g<TGi<.Xb<tGi<+eb<vGi<.O6<qGi<.dp<sGi<fO4<wGi<.O4<`Gi<uGh<MFi<Cac<.Gi<Cab<FGi<.Ao<tGi<RichuGi<................PE..L...k.5Q.................P...................`....@..........................p.......}..........................................@...................@P....... ...B...`..................................................X............................text....G.......P.................. ..`.rdata.......`.......`..............@..@.data........ ....... ..............@....idata...).......0..................@....rsrc...............................@..@.reloc...O... ...P..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360FeedBack.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2788
                                                                                                                                                                                      Entropy (8bit):5.348479691172303
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+5rpdqZPakqs2nH1AyqUBBfpOq1cIGBf49dylqWYFBBfIC25quc7Aqn9emzCZqr:VldqhakqXVAyqoOqJP9dylqtVWqrA+es
                                                                                                                                                                                      MD5:657DB855AC3B5BB5793D1B6CDE2417DD
                                                                                                                                                                                      SHA1:1A6356EF3E03D3C25317F242B28682EE830960BD
                                                                                                                                                                                      SHA-256:B1061943D917241C02AFEEA2CDBB3D09B58E30861A71EEF3B65EC69FE3E27A47
                                                                                                                                                                                      SHA-512:E42CA2593C820236F388D9B39122CE7817166830CC9D5A8D38DC878AE5659C2B5470052E763D45144C6EFDF9CF3D5F3D0FF9BF687DEEFD0A33E7303E03D8FE38
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...3.6.0.F.e.e.d.B.a.c.k.>.......<.H.o.m.e.P.a.g.e.>.........<.I.t.e.m. .I.D. .=.".1.0.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.B.i.g...p.n.g."./.>.......<.I.t.e.m. .I.D. .=.".1.". .T.a.g.=.".I.c.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1...p.n.g.". .T.e.x.t.=."..V.h._8^". .D.e.s.c.=."...~.c...`.v._8^.r.Q...g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1...wQSO/f.NHN.V.h.S.u.v._8^..\.n.2.../f1u.N.NHN.d\O.[.v.V.h._8^..\.n."./.>.........<.I.t.e.m. .I.D. .=.".2.". .T.a.g.=.".A.p.p.C.a.n.t.O.p.e.n.". .I.m.a.g.e.=.".f.e.e.d.b.a.c.k.\.F.i.r.s.t.P.a.g.e._.1.0...p.n.g.". .T.e.x.t.=."..^(uSb.N._". .D.e.s.c.=."...~.c...`G.0R.v.....g.R.N.b.N._...[MOv^.Q...0.k.Y..\.n.1....`.v.T*N.^(u.e.lSb._..\.n.2....^(uSb._1Y%..e...g.NHN7h.v.c:y..\.n."./.>.........<.I.t.e.m. .I.D. .=.".3.". .T.a.g.=.".F.u.n.c.t.i.o.n.E.x.c.e.p.t.i.o.n.a.l.". .I.m.a.g.e.=.".f.e.e.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360Login.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1113016
                                                                                                                                                                                      Entropy (8bit):6.641503286094176
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:+uGlpBgDHNQqYIWG5fsuHycQExuZe1g1ZOjCtg3mWiH95t4ElF:+uGlp+hYIWewcQ7e1g1KCOmWo5t4ElF
                                                                                                                                                                                      MD5:4683D7FE36DA34D5C875615C63A780E7
                                                                                                                                                                                      SHA1:9B8E25F57E5F2593EE27A2623571D0838B61E59D
                                                                                                                                                                                      SHA-256:DECD4A9179E0532E02DA7283CFBEFD4F672899AE23F663F1CB40D41119A5FBEA
                                                                                                                                                                                      SHA-512:ADEBEA3659220F22708810F5CB23007EF731E67CCE3EA48D3DE267D9B2A5DE12B1C63120DF302E299CA4E43AF3024A4AAD6E433B4F2C8CDADD0E86759D0F218E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........txi...:...:...:.m.:...:.m.:...:.m.:...:..{:...:..m:...:...: ..:.m.:...:.m.:...:.G.:...:.m.:...:Rich...:........PE..L....~.Q...........!................\........ ...............................@............@.........................p...3...t...T............................p......p&..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hz.......B..................@....rsrc...............................@..@.reloc..Z....p......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360MsgPushCore.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):812184
                                                                                                                                                                                      Entropy (8bit):6.502754405925657
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:T/nhY+ZXDcGMheIibbzNRVcxr9diftAAo2V3U/tqjGrA0iarnm8JqnZDVcxANbjx:T/XA7YRy5ift421UlqX0iSnJJkZNSTTo
                                                                                                                                                                                      MD5:7947B066A1A4B66CD2B9D086DE45D939
                                                                                                                                                                                      SHA1:5AB237ED46904DCD43B4F0207D7CCB89E50C980B
                                                                                                                                                                                      SHA-256:AF7DF81DC1C593591B92D6E4182A1186E9074204F6954A80CABBE42D2067CB38
                                                                                                                                                                                      SHA-512:9F4FAA55AD701F13F7CBEFF90CA0057BB4AF94B58D3B6FDF02194382E04B698E79E2A94708684BCCE9D9F90F9649078333C2A876653C80918555FA52C1F1D5A2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.*1..Db..Db..Db...b..Db&l*b..Db&l)b..Db...b..Db...b.Db...b..Db...b..Db&l?b".Db..Eb..Db...b).Db...b..Db...b..Db...b..DbRich..Db........PE..L....A=Q...........!.........|......n.....................................................@.........................P...W.......h........C...........H..............0...................................@...............p...l...@....................text............................... ..`.rdata..............................@..@.data...........R..................@....share..............."..............@....rsrc....C.......D...$..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360NetUL.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):229360
                                                                                                                                                                                      Entropy (8bit):6.679890430785069
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:RF494g2HDCpxH/cmBYpDIhjISo9TBVLnW/Z:Rm9OCHfcmBQnSo9TG/Z
                                                                                                                                                                                      MD5:68A3D19BA62C6987E88CB2B7712B9592
                                                                                                                                                                                      SHA1:E9B1C288165D09F2B0833719F7626FB39F96D350
                                                                                                                                                                                      SHA-256:7893BB10C4291D70A48CDC3C65BDAE5D9DFE15DD3F84856CDA6A5A4E51EAAC09
                                                                                                                                                                                      SHA-512:9A84096D56FB0C99A70BE69361FDF5F1ABE4583CEE4CB51FF12EB474CADF3CBD961952C6E78425E544F145A1FE8104B4E044ACC71A03BB30BD1A9C655E413842
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H..H..H..0O..H..0Y..H......H......H..H.$H..0^..H..0H..H...N..H..0K..H.Rich.H.........................PE..L...B..P...........!.................@....................................................@..........................!......d........p..\............b..........(..................................8...@...............t............................text...m~.......................... ..`.rdata..\...........................@..@.data....1...0......................@....rsrc...\....p......................@..@.reloc...+.......,...6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360TopBar.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206000
                                                                                                                                                                                      Entropy (8bit):7.026122439366733
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:cc3bCTobhqLoUA3oLNMALssaPgLWIC5E:c9Tob8RA3o5MAfbyw
                                                                                                                                                                                      MD5:B70E8845A3DFB674910975E6D0C061EC
                                                                                                                                                                                      SHA1:78CE9F4F2EF5B279098756E0A72D6A988D34F0DC
                                                                                                                                                                                      SHA-256:0F3699581E563D52A5485146CAD04754A27209484084A7B766AD99E8B3FA0FCA
                                                                                                                                                                                      SHA-512:B5F72580068F8F5A5A5545C2959D59FF9527E21D0B8BA05F0245FE1FF8937AB651070B877836CE9761D969F1FB8484CA7819CCAF3E9FFF0BA5AC264A7C4DEDA3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y}...................................l.........K........................Rich............................PE..L...-..Q.................t........................@..........................P......8.....@.................................`........ .......................0......p...................................@............... ............................text...*s.......t.................. ..`.rdata...L.......N...x..............@..@.data...@>..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360ZMUDetail.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):911224
                                                                                                                                                                                      Entropy (8bit):7.0009602288643835
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:rRyVJFexWGIXwsfo5kwkBhBy67kty69dGqMzIew8xU1BOdOse7D8BwXeqpDsa1Br:rIy6j7D6ElU1wdBePkMem7KU8IkkvaS
                                                                                                                                                                                      MD5:4CB75E88940FBBF38AA5DA0277EAA5D3
                                                                                                                                                                                      SHA1:B259DCEC0A8CAE18012AE450EE504F680CA64201
                                                                                                                                                                                      SHA-256:7467F2D3792F5A8A127998CD7671175646260718F26336169A8E593527926DE3
                                                                                                                                                                                      SHA-512:93F09FCCBFAADCF8DE94CB090381837843657AA6160E381DAD1F1FF191FDE9F6408E2CF2E889D0CACFCBB9DD6659E0B9B7C458B8BCB6CFA9E35A4CD108E75D05
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h#.Wh...h..Th...hD..h...h..Bhz..h..Eh...h.Z.h...h.Z.h...h...h..h..Eh...h..Sh...h..Uh...h..Ph...hRich...h................PE..L.....IP...........!......................................................... ......................................J.......2..........$...............x.......D\..p...................................@............................................text............................... ..`.rdata...U.......V..................@..@.data....Z...`...<...@..............@....rsrc...$............|..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360desktop.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):29
                                                                                                                                                                                      Entropy (8bit):3.9952378913808877
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:t6UvzTgLNs:t6UrTgLS
                                                                                                                                                                                      MD5:FB6D23E694993862B3D1129E1BA76FBE
                                                                                                                                                                                      SHA1:835B44A308A67C619A2C5AE5C3A42B8F7C9938E8
                                                                                                                                                                                      SHA-256:AA7F835142B4CAA780D24246A47ECCEFAD1B3E52DF8474321459E8735BE8E265
                                                                                                                                                                                      SHA-512:74B80D6504C1286CC8E950F4277FE62136F8304D856E13A078AE79E19CD9BD8FE03426F254242C65159AE72CB0102975774BE279356B7E97A64DEB631D02B41B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[push]..interval=10800000..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\360mwapp.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1416656
                                                                                                                                                                                      Entropy (8bit):6.752223665132809
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:KPEeBM4l7jeAJETbXGHFW3TwIT/GBy4mX4sDLjTl2KuyJ:n4lenQW3TwIT/UmosDPTkKuyJ
                                                                                                                                                                                      MD5:4FF9E97CEF569C059704486FFB498DF6
                                                                                                                                                                                      SHA1:CCE58F7749AB1257595D3F84C8170218B7D2E62F
                                                                                                                                                                                      SHA-256:C909F9799A84653ED3A9FE178963475AA5FE81D5F29CF4DE6B67FDA000C8E429
                                                                                                                                                                                      SHA-512:FC5F8B2736D97E60BC1D73E56C5C0F7585B7FC109DDC59E4962D577C518A4C4F5A342A7CDB2C96F579E3FE814BED123B42770D8D3A3929C3C02BB58A06B19961
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........._.Ef1.Ef1.Ef1.>z=.Af1..z?.Cf1.*y;.Nf1.*y5.Gf1.*y:.Af1..D:.Gf1..nn.Pf1..E-.Df1..E(.Cf1.Vnl.Gf1.Ef0..d1..nl.Zf1.s@;.Lf1.s@:..f1..`7.Df1.RichEf1.........................PE..L...K..P.............................i............@...........................9..................................................... 3..\.........................P...................................................H............................text...%........................... ..`.rdata..............................@..@.data...P3%......@..................@....rsrc....\... 3..`... ..............@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\360mwapp.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7694
                                                                                                                                                                                      Entropy (8bit):3.619105771690974
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:S1TC9oSe9imutxsyYd+diXM0PF2J3L3tH39UFUmAwJDfKfPNYC/IYCPhkitGgU6a:S1TCpmutGtX8/UFU7mxuMksi+HSx/
                                                                                                                                                                                      MD5:FA675781E94327E3D246CD0DB3573CF2
                                                                                                                                                                                      SHA1:2688FF12E22EB024441947847D6DA5862D6D0AC4
                                                                                                                                                                                      SHA-256:A1844D90CF53A960A03912C6B5E7F7A16626C746F26D79101400534B0161E62F
                                                                                                                                                                                      SHA-512:45B09BE3EFE982644F7BDB91EB7870DC3DB812A780BEC2806CE51684563FE03ADC565B7876F6679AA601A0DC2F0952337B6DD593A3F4EFFCA97F1EF58FAE4B3E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......[.M.a.i.n.].....A.p.p.T.i.t.l.e.=.t.e.s.t.....U.s.e.S.k.i.n.=.1.....L.a.s.t.C.h.e.c.k.U.p.d.a.t.e.=.1.3.4.0.0.0.4.8.1.8.....A.l.i.a.s.C.o.u.n.t.=.0.....v.e.r.s.i.o.n.=.2...4...1...9.....C.a.s.t.A.w.a.y.=.0.....A.l.w.a.y.s.T.o.p.=.0.....V.i.s.t.a.S.p.e.c.i.a.l.T.r.a.n.s.=.1.....S.e.a.r.c.h.S.e.l.=.0.....L.a.s.t.R.u.n.T.i.m.e.=.1.5.:.3.5.:.2.4.........[.P.a.t.h.].....S.k.i.n.=.d.e.f.a.u.l.t.....F.a.v.o.r.i.t.e.=.....F.a.v.o.r.i.t.e.B.a.r.=.....I.E.C.a.c.h.e.=.....C.o.o.k.i.e.s.=.........[.T.A.B.].....F.a.v.I.c.o.n.=.0.....S.h.o.w.H.e.a.d.B.a.r.=.0.....M.i.n.W.=.8.0.....M.a.x.W.=.2.0.0.....A.c.t.i.v.e.N.e.w.=.1.....S.h.o.w.T.o.o.l.B.a.r.=.1.....M.C.l.o.s.e.=.1.....R.C.l.o.s.e.=.0.....D.B.L.C.l.o.s.e.=.1.....R.S.p.a.c.e.N.e.w.=.1.....C.l.i.c.k.L.o.c.k.=.0.....W.n.d.T.i.m.e.O.u.t.=.2.0.0.0.....M.a.x.C.o.u.n.t.=.2.5.6.....A.n.i.I.c.o.n.=.1.....C.l.o.s.e.B.t.n.=.1.....N.e.w.I.n.T.a.i.l.=.0.....C.l.o.s.e.T.o.T.a.i.l.=.0.....C.l.o.s.e.T.o.L.a.s.t.=.0.....C.l.o.s.e.A.u.t.o.M.o.v.e.=.1.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_address.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):378
                                                                                                                                                                                      Entropy (8bit):6.911583061847822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDskGDVJn6dD0B3hFP/kVKqOk84kTfhZDXLk/MP+6yTirUp:6v/7i0fLkGRJ6dcxFP/kEdk8hjDXLk/D
                                                                                                                                                                                      MD5:CC56FDFAB4489EACA44A27143AE9AC2B
                                                                                                                                                                                      SHA1:FDECDD5969BE0F89500C6402C9C64B202A6DC4A4
                                                                                                                                                                                      SHA-256:163DB940619596F0569EEB0B7817C799C301E9270C3BDF85445F0871C4971E1E
                                                                                                                                                                                      SHA-512:A8BC28ED92CABD4D8102CF57A54EBB1FCF8AE2C9E080BED37D56F5BD156BC9BCA5CBF3007B66C0D86815099ACCD82DCDA900EF0169353267C82265E36C1554EB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bb``.... .OE..j&..++k...@....%.*...3.{.........Oddd._.~]../........[.y?.....?..,C-.A.d.g.dTTTd.....~...@m...AXX.?....-.....L.H.... .io.....,......L3.@f..`..T........hb..l..n.+...C .A>`.V..MM.j........?.....C\\....J.(N.Z...............k.zEEEjz...w......Y.D.:b....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_addressjk.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):375
                                                                                                                                                                                      Entropy (8bit):7.137923455086985
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPK05l0znDsxHtqeQHf9FBo4ftBb++V7QJxaqWnF9xxY/51EGzHsDgTel/Vp:6v/7i0fLptq1H1FlBbiPgFmv7SX7
                                                                                                                                                                                      MD5:679EC2BEE9EE3A3E175C191B57D6809D
                                                                                                                                                                                      SHA1:C65ED05227FB99A41262D93802FFB246490AE146
                                                                                                                                                                                      SHA-256:2A35A97E93752B96878C801B678E126656066EB919BC39A07E7C0AA03746950B
                                                                                                                                                                                      SHA-512:7DAB4E8C67990336473C7CB1F9BA782E42E352182FB424E3582BD82B9C7AD0C16D4CB845D933E5A79C4A8A1568AA38FA3AFF9EE838900FD6BBED8708573594B5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR..............!.-....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.@..G].......#.....w.-.Q.=...Az.s..9.A...6...-y..@:._..};3...Xa..I..+s.,..s._.,;.Q..l.}.&... ..Q...a.8..u]......P.H.T..H.DVUu1=.i........4...Rl.1....m..M...;.......q.m.....[,.QW...F..qL..K.F....(..o6......e.a.8..e.....9.`.....`x.?1C..OM.P6.9..0.1.f..2.;....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_bottombar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 28 x 70, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):895
                                                                                                                                                                                      Entropy (8bit):7.736770296459366
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:sS89NJziudHJ2OsjhS+lxn2EEeSEO8aIW:sSUmSHwRtSZoW
                                                                                                                                                                                      MD5:110D93BD46D87E3F9F2C22B984319BE3
                                                                                                                                                                                      SHA1:F4CA5A7E2838D4DBCA6B8E5A85FE31C368792745
                                                                                                                                                                                      SHA-256:F08DEEBC0E0573FC0B30C5F169D7912C3EE683578CBB45FB8CC5273E56A17108
                                                                                                                                                                                      SHA-512:92D7C5D1C644EC2C7EB18EAC637F327437980225B3C7DE0FDB3EAF4DDCED12715512EF3EEB4682DD6F4A89F29473F70B57B5BCBDA77549809AEAF53279547CE7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.......F.....PzcR....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..WKn.P..0:H..z....O..^.f..T.U".0./...<rfHJ............/n.~........Ao.......#.>J...Z(..~....x...."....#...A.........).gt..1...s..w.Q>.*_B...3@...h.H?...{..W.}FH...3.w...(.......+.).hK.JX[.(...r....l%.......7.......p....2.@L..hE....iX.CU...H]Q..f.A9....W...............-y.-h.XB38.8.\.)Z>........9.\n....E..d.(/...a.....[Di._....a;.........Y.i.R`o.b..4...$...%.....T.J1..M-r...QN3.u...@.5......*.d...7R..6Y...L....J....^.tO..1..u......].@.l...U..k}.U.*A....[./.y.D...............8.d...6$k9.@F.S.m,.4..d...PT..."m.[EPu..q;......:.kyk...}.l..P..K..6....".{3J}.w...^K..4N..L`..P....l........}+<......r*Y.2z.$..)....:o.$*..+V#...7a7Z...S.%6....T0.P..0(.6].>...5,.|...2..r764...1a.vf..*.bjwe.....g.R..v.`~.m9.9.`..`..=[~..{..9Od.._..h...N.9.w.GG<..&..D.. pX......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_combocool.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):923
                                                                                                                                                                                      Entropy (8bit):7.656747347784116
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:XiAybG+xVng2RZGlVvsbZ/2AxC0hchImNd:XinHxKEZRxSd
                                                                                                                                                                                      MD5:66E91EE2905FBDEAA4E5C2313B8FDB13
                                                                                                                                                                                      SHA1:B844EC343F2268ECBF4BEB0CD4D15D3033D2B17B
                                                                                                                                                                                      SHA-256:E787531C78ECF94B1BE9166E1667F41D9BFCDBBB771B9CA9D97C02384287761C
                                                                                                                                                                                      SHA-512:943526A7CC15571AA8E37301D839FB0762D0E4F25D0B44B983A192A480DBE6C09F8FA870528119C8BB6D3ED9DB7C6391DF5EF9A9060C475B1989711E99648505
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..KK[Q..wn...VP..B...HEl....$j....I..t"..ZA...-8...:.C.*.....5..uZ%.....=.!.....9g.....9...J....`...A[$.i9==m....///s."....5.L.........ii................M...V.....H....POzk.HNN.....`...f...v...r....;!.........@........[......@..f........z..w...2...../......H4.....If...r.....C.rZ{zzBsss..@###.....ogf.+I....X...+[IIInoo.......#..{}}.....jP...F.\......{{{}....yJ`.Im2.E.B...s..?.0.P...n..k....:....Dm2..I...qZ`..@.6..NO...A.x...fu`.kP..d..!XVV.s..(jR..d....p......Q..d!....j)//.....BQ...&.X...RQQ......UH..5.EMj.!..y.......s.n...*....5.H......@._477.9_[[S....l.A.61a.....%....SSS....V.......`P...1a4...J"..X,.q8....$V..sqq...........ZONN...u..a.cTG....0....3..........ZUU...$......Z...i..j7|t...@*.....1.....P.....8"...............z:.@...A..0VO2.([...D+,...>...._...!..4.5w.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_combocooljk.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 36 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):888
                                                                                                                                                                                      Entropy (8bit):7.608052775689205
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:wPD5/xB8ESjaqJDjFthuOB1tn9i+ez3eiJqsGNU:wPF/DBSjhpFvd1tqeiJqJS
                                                                                                                                                                                      MD5:B0A2B5855260AEBA0BEA2A6AF4421167
                                                                                                                                                                                      SHA1:49679525EEACA9A97D910F6F0904883838E3D2A1
                                                                                                                                                                                      SHA-256:5FF7AEE15318830BC40EA1402131AEDAF8CBFAD2AA914A628B5BF1D4B59703AE
                                                                                                                                                                                      SHA-512:5F9C579666EEC68A1873469B010DA5AE9739BFB8326EDD009C9D795F4EB0BEB39C4DBD634B9577C8BD3F8D5EE3CFB9CAE492A2A4728A0C49FAE969E43E216A82
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...$.........Y......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...OZa.._^P.4...A.W$!.J. 5..B...C...X..v....P..]:....4.!..!..#.....yn..i5..r..{........`P.E4.ex.E(.....N...M\^^.noo.777.ZDL&S.h4f...6......c=.Ln=.h~~...;....)../..............WK)EKK....Z........Z...O.b..'...._......Q,..........eq/...A-j>...L....!..B\W....A-j.,,<@.y.F...l.......I.^...v..uu%P.C..MOO.O.R....0.....!0....I.B..R#........wvv......m.z<,8}..../...d.T*..4...Im..J..Z.a...T.....d.V.A...`..cS....X.~....=._............@..V...lj{.....&.YdWW...hmm....d .....0.T.F.NK........}.......z.6.!P..5.........-.-.|>.6..w.jR....b..`..../.f.|tt.vOm..G.D../"....###..^o.a...V`?.f......~..6.s..Y<E..LZgg.p....ccck...."....c<..,...\.7.a+.....K.Z...../S...!.N..............vee.....K..k....V.j...}%.#.4..7...L..g.|...Lq..H..!..[..."B....j'.(..=n..o..Mv..`.S.}s..g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_menubar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 400 x 25, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2902
                                                                                                                                                                                      Entropy (8bit):7.854538720952291
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:U/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7pz:USMllcHitlIxv9vk7C1+I4wWHLihk/xl
                                                                                                                                                                                      MD5:EBFE7A6895A10C867E4178A8F34E2450
                                                                                                                                                                                      SHA1:F0DFEB6F1A01CA08F83A98F194DC7052F1913CBC
                                                                                                                                                                                      SHA-256:1D6AFBD5A688698A73C252089C9EBB8E5DAEA31AC2F701C7E7FC52B1D207E640
                                                                                                                                                                                      SHA-512:057DC9A7E4E60560BC3564B658FBD7EA9448C4407D64ECABCCCE32C7F8D13912A279C6A836ADB571CFC7B04DEB1D3C85CF56E1DF4741B92A6991395D6B161BF5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................?....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_titlebar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 180 x 23, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2944
                                                                                                                                                                                      Entropy (8bit):7.867012956447315
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:j/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7up0:jSMllcHitlIxv9vk7C1+I4wWHLihk/xR
                                                                                                                                                                                      MD5:E7854C688AFC786BF49BDD6CE61521BE
                                                                                                                                                                                      SHA1:DEC0B971F56FF413262E4619E1610975CA6D2846
                                                                                                                                                                                      SHA-256:5A0819E87C40D4F548301F601A44DF02BC4D2E8AB1AF30D6F7AB76C77701BAE9
                                                                                                                                                                                      SHA-512:A8304875C2DF8C6FA2C8CA9910A867FA9285519FCA055ABBE344FFB7C61A49559ED29CCC8043666B539E14B6E6F0214B40E082BDE79AD17C58A99AAD3BC346A9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............-'.%....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\bg_topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 480 x 127, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4458
                                                                                                                                                                                      Entropy (8bit):7.848831874056026
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:n1PinBKex0NHeZOJnKb2tUsnL6xFRiljhz2kg+F2WLXbgEmtXKm6YYwI:1KBKexBOvthsRi9hz2SGZu
                                                                                                                                                                                      MD5:4F1705C49D8B08621D8F47D6868CE563
                                                                                                                                                                                      SHA1:104C2E7DB170E423D34892366548C3D9FF3532BB
                                                                                                                                                                                      SHA-256:27F4DC9C58C766D8DEF55A8859DB30DF28168817649DDBE17E710A7A72606D8C
                                                                                                                                                                                      SHA-512:84738EC8FB0AE48554E81D427B537E1298C4EF3C9EA961F8E8E05ACED7284C3FA333F7A87B65C785EC03E60342B7E73C179E4DA5F41B4572DDD9E754BE511399
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx....7...Z{.^..S.....O.?xO.=(B.PT....;..:i..R.v..Y.O...#...H.G~.._....z._....".).b.K..[..{.~.pEu.G.....v..Gv.EnY..H*.v......vU.U......[...+)...).\<-.h*J..J...-.t...].>[.{.).-.(...m.T .&...w.....z.,h.B.....,rQR...n.r.;.ii.\.\.t{d.LOP..hV.\..^9...4C....h.c.$....;I....N.]...D....K.$b".k"R9.`.n......b.RwS....R..w..%C.;.V..v....I.g..t.$4.....S_..4Q...!..d..Dkt...^k.w..$.w...!SdzR2..r...1\\t.e..tbh.?...^:.;....Ly^s1..E........rK.u&.9...cd.......<...lA.....W[..i..y.%....8-a.<..!.!.5S^..)m....6-).uqc.*[Yi........J+..m..`+MJ.._E.U`b.*Y.Pfqd.LON...Zt...Mm..V]..rcXa.&h.[.%).t...{.a..V..K.K.~.$n*H......5.<;f.g..5..s..c.l...l..)..5kv.{..3.....W.+?..K.M.....x..k_.....q.s..V..o..;.P.Yz %.P..f..{.eR.d+D..Q.2..E'Q.ce.l.L..."I.b.c..!SdzZ2..4..f|)zHRy. ....i&.T.=.(f..o....sb.&...Y..-$Z.!f1j...H...V+.......z...l..`.k&...IfE..^..S.R...1/p.-.s..V.ii.<b...P..E..7......UI"....G.z

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\btn_title_close.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 112 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4388
                                                                                                                                                                                      Entropy (8bit):7.912014293635645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:oSMllcHitlIxv9vk7C1+I4wWHLihk/xJCb32oVZBfXtLK5e/iEuV:oSHIIHUCD4waDS2sffXt+s/uV
                                                                                                                                                                                      MD5:D4CADB6C7F66D6EB63524A4140CA1871
                                                                                                                                                                                      SHA1:A00C017C57AC0BB45A2CA62F7E42AE17A02B96BF
                                                                                                                                                                                      SHA-256:B5DB14B67EF9A65951B5F48F88BBF1F9BBF860240193AB67614D09BD34CCB2BA
                                                                                                                                                                                      SHA-512:06350530B94C26D30A0B24D1320071D3DDF27CAA30CF442EE64DDD0AF962FBC964C45BB1CC45E1C47D4870891A474B4AFDDDF5927701C2EB400E92B071922E64
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...p................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\btn_title_max.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3741
                                                                                                                                                                                      Entropy (8bit):7.899231445675867
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/xKsCmeJ:2IIHUCD4waosiJ
                                                                                                                                                                                      MD5:A23B225B6D0B54B8DDA157047ACE3A33
                                                                                                                                                                                      SHA1:EE403794BF7D7B6FA7FD34FAEE982E08EDD9A5BA
                                                                                                                                                                                      SHA-256:D5C219976828E95119B4EEE98EEF949E0D2B451B03097D0BB51633888F784A73
                                                                                                                                                                                      SHA-512:B5FB8038993647D1D4A6618D11AC6C6F156CB8A1E8F643B5241E7C11C567D80ED753DC05AF00F6704782E40BB1746CE42AA3D9B34BEB59CBBCD321F4D9303010
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\btn_title_min.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 116 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3354
                                                                                                                                                                                      Entropy (8bit):7.890717225229663
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dllcHitlIxv9vk7C1+I4wWHLihk/x/eiGKlWXbp:2IIHUCD4wadSKG
                                                                                                                                                                                      MD5:30304F398F360D180CCDCD986F0E4D52
                                                                                                                                                                                      SHA1:5840F5D00051B44B4666373711FF3D5C5380CA17
                                                                                                                                                                                      SHA-256:332E9605BB588B8113167DF564CD0A4463701E60526EFEAB0575621214A068EE
                                                                                                                                                                                      SHA-512:C111BFE0C6566FEFDFFD107DD4BFD4196EE4DFAE87EDF0270FE3397078769EA34B9A2A44BA6A42D65A628C847B95D67B6E328AE86F586E625A02520932C633D1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...t...........k.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\il_statusitem.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 208 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5267
                                                                                                                                                                                      Entropy (8bit):7.956195186420475
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:finFlEbEhgZPgh3wBAep5ljSECEDAUQCUuhPldTCzpslcfMl/Bf:firkMxEAwma3ldT2aln/Bf
                                                                                                                                                                                      MD5:2CFD765005431ADAAC5CA4C9FE73ABCC
                                                                                                                                                                                      SHA1:99A1ADA7BE44393E827E9959C536C39043CE6637
                                                                                                                                                                                      SHA-256:98C36162E3F977B1AE6E68CCEF6A6541ED2CFCB6FB455E53CD24D1FFA7FE55BF
                                                                                                                                                                                      SHA-512:2AF338B4AC2A495314E5ADD13C36AA2FC40D6929C8EEA77B89F06FE5EA00986A4BF4543DEC7DE5C19F7E16737A4AE50693663E8CC80AC4A996C5C5AF750A8BA1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............gL......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...%IDATx..Z.xTU.~.d2..))$aR ...`(J.T.....?..,....... R.].D ......$.l.4!B..$.J.$...s..3.Ld.g.}.=z.....)..}.w.\........~^....Z-...r7.CmueT.B6S..2.'...;...57T....F....!..e=..@..L............"...m.U.pa.^......w^y{.{.H.......W**...J....x.X,..{K.[ ......L.....""!..C'....V.Z%..l....7E$.......u..M.6..........e..aw....t.9l...4..Y.....4...@dP.Z.......o.......B......I.x]s..S.....^..l;..x...h..,a...#.....f.Xb....L.Q.xh.n.k.y'O....8..S.=.O......[...o.:.U~q_.."...s.....G.9l=.h........=.......9.y.f.X...1c.@....^n.5X......a.l.m...e.?...&..b.....{o..c&..........d.LH..FL....).l..OO.?....v..0..$&..Iw......t.w..H.8.......a....kG.Um=v4}..=.O......j?~.]....D....}\.Y...y....'.,Xp[X..i1B^p..)I}..+.&..*U.9..o.c.d..7h}...B........&)........L.;w...co.wv....}^t..z*3}Qg...h.T..MM...-;.1a....7I..K.......i.3.'.P"..L.Cll\;.........1IPxU.6....pX.`kT.Q.bL<.m.A8S..j;..q....@U..2.LiT.>s.:..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\img_sideband.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 4 x 49, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):158
                                                                                                                                                                                      Entropy (8bit):5.71235322396329
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlJOtEll7ncl0tRthwkBDsTBZtVdEAX22SQPx+PhitB1p:6v/lhPatE/gl0znDspVmATEPAtjp
                                                                                                                                                                                      MD5:5118D10C7EACE902540AC439524318CF
                                                                                                                                                                                      SHA1:4E077F9814418BFF4180EB0EE01846739D8524B8
                                                                                                                                                                                      SHA-256:1A4D1DC5012178110061C72F88B019E59428744D5B98FBC4862945362ED217E3
                                                                                                                                                                                      SHA-512:1AE78BB7A49E49EAC6CDA168202C35C3B7706DE545FFC89EF765FF4416C4EAE8D205DB7EEA815810F53284C71BC67F5FFB0E83A12C417BC909F33090F4DAF051
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.......1......F.`....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...0IDATx.b...?.2`...W...t.R.\@]].AOO...qT..Q-P..`.............IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\size_status.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):211
                                                                                                                                                                                      Entropy (8bit):6.330054257939168
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP8AMzl0znDspvsKhlyVQ5Yn3xJRyr+px/bGX+lVp:6v/7kAMpLhhlyVQGhny6XEA
                                                                                                                                                                                      MD5:A5099D3544E5202E9AEFFF353DE2C999
                                                                                                                                                                                      SHA1:026DEA383560874AB38DA3E192F2241E3CAB9F60
                                                                                                                                                                                      SHA-256:6FE17CDB2AE87788220F6D44551A6918111AFA6D1DB20E0BBD050CAD418DC7BE
                                                                                                                                                                                      SHA-512:09F87D3D4660BCAF98AC6D9CBDC24A59230FF4A7724C2317FEAC61D196EE360A87A1270A1C4C8FD41B6EE647D767E7BAFEB55EA1C517B962460BD33F78FFDD02
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............w&....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...eIDATx..... ..@$i.:,.h.7..F|d|.x.nX......^k.Wk....).L..8a)%......Q..Q..y.#3...G8;....~;.p,........oO........IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\skin.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5489
                                                                                                                                                                                      Entropy (8bit):6.585852073568794
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:0rEQE5pOV22c4LeR4Vraj7mKZTM8sAT8BDRYknQloo9AoIkKqIy/q:0rEIVxc4a9jv9Zoo9AoIkKqXq
                                                                                                                                                                                      MD5:E1398061A627C60593085CC1386B6C68
                                                                                                                                                                                      SHA1:647E88E4A8B910229F8C7FE76F2D4B783FCFD648
                                                                                                                                                                                      SHA-256:B65FEE9AC2F2115808424515EB04E5D0FA10709758CC7E95DF01D355CC00D5A4
                                                                                                                                                                                      SHA-512:AAC734FF7C9F0A8032365F57B8AB861F096A9FB3BAEF0EB32616FADCDDA630082F2683A48C2E6A790C738D745B2B9917BC2ACEC98CC6A695B62EC7528ADB569E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:#read only..[General]..Name=Azenis..#.........Author=JJ Ying Create, Breath Modify...#......Comment=A 2006 GUI Champ Best Overall Visual Style..#......Version=2.0..#......[TitleBar]..Height=23..#.............[SideBar]..Super=0..AlignSuperTitle=1....[Rebar]..GripperCX=6..RowLine=0..#..................0......1.........AddressButtonSpace=0..#......................SearchButtonSpace=0..#........................[TabBar]..ItemLeft=12..ItemRight=12..#.............................................#................................................VBorder=1..#..............Y...........PBorder=0..#...........................[Browser]..Border=2..Spliter=2..#............................................[ICON]..FAV_DIRECTORY=fav_directory.ico..#...........FAV_URL=fav_url.ico..#...............ADDRESS_URL=address_url.ico ..#..................[IMG]..BTN_NEW=tool_new.png..#...............

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_bg.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_bgb.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 14 x 34, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2859
                                                                                                                                                                                      Entropy (8bit):7.867114596125591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:L/6qbllck+itY5vm7I6Wzv9UAOb57C1cSMIg6lc3d+0UWHdVG/jJtFo3/d7ktix:LSMllcHitlIxv9vk7C1+I4wWHLihk/xp
                                                                                                                                                                                      MD5:AAE68B8A344FE22BE2A4066C05A0A56C
                                                                                                                                                                                      SHA1:38C63AADFD84418956C37FB095FB4A5B638AF7AC
                                                                                                                                                                                      SHA-256:F2F60183B3CB103334765B5AE2CBE1CED80FF58D008CD48750D650A58C3DDC22
                                                                                                                                                                                      SHA-512:FB3733020659ACC122948843B25BA4806D4322DA08CFCFF00AAC410700B2032B71B6D259C901199A9362826D8BCC1F4118E1CBC53DA0909DB7E649A97057B819
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......D......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_btnclose.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4467
                                                                                                                                                                                      Entropy (8bit):7.887524585572367
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xwfKkLVVi/xMQye6DWfaKl:dSHIIHUCD4waWRVVwMCnzl
                                                                                                                                                                                      MD5:D6C5EA4C704DA7C98288EEAE2C4B668A
                                                                                                                                                                                      SHA1:C55548295A566EDF4FB1047D6543CEF93AA7D792
                                                                                                                                                                                      SHA-256:FEB9889385BA65246180CC47694BE22B81344B4141383C1F5DEE565C249ABF84
                                                                                                                                                                                      SHA-512:004EA99AD6027AF356A7CE01ABEFEC9514D5BF2ECF275B1A72C0C44F631EFE10599CFC0AF48DE06516C2784D56FA59D406C8AC20DDE5C285EEB7EDBA93279642
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_btnleft.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3641
                                                                                                                                                                                      Entropy (8bit):7.901710647211874
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xQJWHAFfvUmyhpy:dSHIIHUCD4wa+WHAxhOpy
                                                                                                                                                                                      MD5:B112B85C2FA8B2520A5F0D5D63E19E63
                                                                                                                                                                                      SHA1:991841D56BEAB6F9E01810510C14D18EE992C5F3
                                                                                                                                                                                      SHA-256:EF7BE34F2A38FA86C0A01A65CAD72AF086105EBAE136F0213BD10F86022F7473
                                                                                                                                                                                      SHA-512:45EA3B364D7E37886804067D160A3C066C038393D2FAD55A18DCDC65D3A58E38903AA1F41D8455887C4F4A9AE069E3478753E4180184E99C602B05C135A563CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_btnlist.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3429
                                                                                                                                                                                      Entropy (8bit):7.889410060546279
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xE94bNjeIW4Ntv:dSHIIHUCD4waRQInD
                                                                                                                                                                                      MD5:7EC39872A2DB36E8915D6AA8E2F881D5
                                                                                                                                                                                      SHA1:224A440E2B0660EBCC89C3AD9A880A08F57F7D16
                                                                                                                                                                                      SHA-256:E8FF2A17DC40ED150B1E53331C131190D7CA3ECDFBFE995E4226099BD66FA406
                                                                                                                                                                                      SHA-512:CD32E9704BDE2462F2B411489F5DBFA974E3D00B37A0C81EFD524F2E006A7773F4A2ABBDC9AE9363E3C20E63DD54EB550FC3E8BB574496996A171B0AD8703E5A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_btnnew.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):786
                                                                                                                                                                                      Entropy (8bit):7.546808003957644
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:LmaCT4VwffCMlEJ/ocRnaqxnZVXPcs20C3naWrhlm:LmSwffPyJRaq7VXP520C3nbdQ
                                                                                                                                                                                      MD5:0B08617981E18967F72525470CBF3E77
                                                                                                                                                                                      SHA1:2A79C7EADB99B2ABE4BACDB534369C9F048AD37A
                                                                                                                                                                                      SHA-256:853D1856F1BB147DA4F791C187FCBCDD70A677E49585BC01F9FEDCAB297A6567
                                                                                                                                                                                      SHA-512:86A4D861645EAC50DFE068AD5DB567FDBDCED333908A24BA2AC1AF40098971F6636975615309F6F167F3C3E7503F912EAFB60DF29E75360155BE1F0FEF367052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...`................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ZO..@.....<$....."^.R(.)...........=..So...~.~.^\X(.x.\*TQPH.....4....d&..<..A.o~.7o2...n.DrPe.....EQ.7.fS.....t......D.N........X...d2G...P...r.?.tP.#0..7W.Uw:...pH...D..:)..$...M..I\.......dB....m;..a..R..B.@....t...lFF.Q(..R..r9....V......~....H..b..j5.`.....{..kn...z.....i.m...V.0.h..h..=...*.....(..@.G->..p...y.....p..y..-....@.#vx.\.>.......py.Hl..A3..x\.&h.....q..../.C.9@B.9.X.....W...W......Z..oo..G.v........E.Ae.^...._....F..D...K.........8bc...w?....;,.<.._.z...>.z*.....?#....H6v...........?......>......gc.W.%.....0z,..C Z.......R...._..X..M..xQp......8..l.8..;..Q.....v9.X.l.....?..D.>u...C%.......(..%W.4@B. ..H.......s..E......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_btnnewb.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 96 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):305
                                                                                                                                                                                      Entropy (8bit):6.175730934146871
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPkl/O/6TMMAYfvl5uUdHlOx815NwNYZbbhEzNoPoopj32OpXp:6v/7UO/6TMqUwEx81/Z/66dcAZ
                                                                                                                                                                                      MD5:0408523A403C234A6FF5A73AFF360BE9
                                                                                                                                                                                      SHA1:309304547079031CC9A7FF87C52BBD55CB82A68F
                                                                                                                                                                                      SHA-256:4EBB1B2E9B7C5D035637D980BD08C67DB341B8CC1C3337E7D07774E2650CD1DA
                                                                                                                                                                                      SHA-512:92C3D04F97C402BDE63532DAD510BB467409591BD140BEC0665952D49653352F577B0E3FCAC7B5FAA7964EC81324B6EA67AD3AC0F823AEB52C7F25868DD2E778
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...`................pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx...1..0.@.x...8y....G..B=.....P.B. %.A..\~J...I.1......@.. ........l.<|.O..|..C..?>i..m>.wz.....l...M.u..g.DM....Q...=sd.$H.......?$.6...@.. ......@._.........0/V.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_btnright.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3664
                                                                                                                                                                                      Entropy (8bit):7.891018711426157
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:dSMllcHitlIxv9vk7C1+I4wWHLihk/xjntMr/R:dSHIIHUCD4waRntMr/R
                                                                                                                                                                                      MD5:716E2DC65E20E05219E10C230783356F
                                                                                                                                                                                      SHA1:30B0C796C5AD8D3B623F7D67F6F974F07A61FFC9
                                                                                                                                                                                      SHA-256:1F2F895C8E4CA97F21B31C0C6403AACE8F4339D92980B7A79B53B375CC85C8FF
                                                                                                                                                                                      SHA-512:A137905D889304948059647ABF87A1623321A01246EE47E8B89816AC49CD69927D1D60C0DCC52F408F0C413205AE637E2B3BAAB75D72D4DFF2C1CEDA6FAFC26A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...H.................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_close.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3914
                                                                                                                                                                                      Entropy (8bit):7.895999769181624
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:ISMllcHitlIxv9vk7C1+I4wWHLihk/x7a8TnZO83:ISHIIHUCD4waj
                                                                                                                                                                                      MD5:0F48448630F47F51E9E309B7C88109BB
                                                                                                                                                                                      SHA1:60250A7CCB0F464DE5F3FFE60C5EA1596A997BC8
                                                                                                                                                                                      SHA-256:3E439DDDA28EC24F0DCCF14DC427B874439E9F7502F8FDB1315E9180DD949BCB
                                                                                                                                                                                      SHA-512:245F230F6AB9062E9FAE8E90703CFF77F22D2681C584B9CFF6D6B89FCA97E1C778B87530C4FF7ABE802973207D0DD00617082B017F6D820386CEF9801D881207
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...E..."......|......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_item.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3722
                                                                                                                                                                                      Entropy (8bit):7.899224106584947
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hSMllcHitlIxv9vk7C1+I4wWHLihk/xrXwL+o9qjbdc:hSHIIHUCD4waRg9qji
                                                                                                                                                                                      MD5:45FEA5118EE9A74839DF56DAD84F56AB
                                                                                                                                                                                      SHA1:A0D82C69D219CB8CD1404EB0166EF8B8C748B53F
                                                                                                                                                                                      SHA-256:43E59E4ADFE9DAA9EAD1ED41FA17C6DC8056EB14FBE41DE60F4FC7A665BC6E93
                                                                                                                                                                                      SHA-512:5ABD0174FEC6B8EC0AD9B0F38F52090958ED43837925F34A9136F9C60558B2C99203E9E13BA0761D2F486CA7BBD078D1CFF2E053B533A92D3100A6236C061F88
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tab_itemb.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 144 x 34, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2608
                                                                                                                                                                                      Entropy (8bit):7.882785296810761
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:TDsqWxNpSU9R+FkrZaM6UbI00CGGLS3fIOYHfmonECkORJGk56JFPxGjfknTGIh/:TDsq0SUHnaBCQCGOS3yHfdECN96JFpWc
                                                                                                                                                                                      MD5:178B8BDF1962943FB5DF07AA07A99250
                                                                                                                                                                                      SHA1:A8FE3CC3BDB2F33751EEA61AD8717E00FAD4546D
                                                                                                                                                                                      SHA-256:78FE192F2FF86421B48ACD46BD1CD78D319C47007ECF4BECAAE4F4B82C86F074
                                                                                                                                                                                      SHA-512:DBCB024A2BCCF977AC148F8D4E5923F181ECB217B19DB775CBC9F4668CC9F31B0897BD816FE76DC98684EC6D9316F573E1EF40D14D94E3A79EF40D9E3CDF8395
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR......."......DP.....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[Ko...>w8|./..%.l...70.....].(...MV.......?h.n..@..."....]4M...$....%Y.H./q...3s......aj....$........sy.I)a.f.M......4k.....Do..`j..>K.cd..<B(.h....b.g.Y...8D..Z...,..%..giD.....Ek).c<.D.)P.F.....V.V..hy....(.....F...m..5.:.x+...,}..3i..gVM.@...wZ.......5..j...!HJ}.<..khw.^.pc......g.J. .%N>PN.B.L..6..*...f[.?..+.....DqS.0.J......8*K.]/.g...eV...O.....i.Z..x.!.....9...........Y.)Xh.)........}....w......&...+._.P.No.../.7n.....@G*..@8...\~i......-..P,.H...GW.4.....n.uXn....|..5.0~.}....7().s.....T^.....x.B<ow:.).....y..g......o......a.....`.",WJ.^_......4.....I`...+P...u.....w...?.vk.M..h..&........7nf...A.....r..|v..>|..L...ad{G..?.D1....#.S.....y.x~...}.$....:.X7...v..7.C...;.\.8.}.8.S."O....4.D.\..o...^.....-......;v.J....B......u...5....S.s.a.........T.5.@y<....<P...K...Pa....^..A...R..y..@..+M..vHd.6........|>7..K........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\thumb.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 60 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):518
                                                                                                                                                                                      Entropy (8bit):7.326106620215251
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7GLcAAqRUUpp359ikkBi4Q8pnTZtEWUQqBugrt/73:AAF3/359iq4ppTZtBPtgrtj3
                                                                                                                                                                                      MD5:A19117ABBC4882C42E88A2C6ADEBBF80
                                                                                                                                                                                      SHA1:A1939BE01CB3818BE8C4F37730BAD3E68504BFC0
                                                                                                                                                                                      SHA-256:432616E5DE7157AE72488B761F15820841111E261588404D6DF558B15D80AF50
                                                                                                                                                                                      SHA-512:6F2C9B881694FD621DFBB418B45953D132D21A8989705B406A8FE9F543890145167B1CAECB36DF690E5285673978CFC7A1983D9836FB93CA49E875C4CABD447B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...<...........?Y....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.H.L.#..zx........+V.S..6..'\....T..Ak...ZTv.5..a.*;p......8h.yX......@i.t..?...b...3|......`.....gg.x..b..4g!.....?3|..........M.y.z..>fgg.?x...gNI.............RSS...999.W.Z.i...R_.....W.--.g...d../B. ..A..I.;.....?{..=...4...i^hX......._2.....Y.."...../.^.d.6...t. ......\.........eff...rp.WRR.....b...hKk>.[Ft5o...Hmi.r.JW.rss.N-0._.....y0._.....y..C<.....G=<.............(.F....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tool_go.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3112
                                                                                                                                                                                      Entropy (8bit):7.923572389677524
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:n37DTYmEYkOTrzGzTb40tllVYbG5DCAatTSytJtSak48ShiGJjAHs+zn4YiZCXEI:rDuYbITk0tllVtdCAaH+aXNhitCA0Qnr
                                                                                                                                                                                      MD5:8617CC17BF0424619372F86C37EAF521
                                                                                                                                                                                      SHA1:FA3F25348D619320F7642732A925B9875EFC077D
                                                                                                                                                                                      SHA-256:C474475EC789A4C47972015385A8D6AA74289A9B6A995380CF32940E9ED0FD54
                                                                                                                                                                                      SHA-512:E716D8B66C2CA7D55C1B3B133A8CE821F9DB9164FE6F4B20F763B2B60CD8A2182514E7CA781C7C85C9B8AA8CE4FE787664BF8DD34344E5B22CB5B2D896F035E0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.o......v..v.m...).i).}...XS1........a.~.J[...........4...c..n%.+m!....&m.p..N..........$d.l..Gv._...{...s.l6.....p..*...%..&..`....A.."$.1B......$.g.E....q9...i.<.P..`#T.j...B+.......c.A.9B?.O."..Q..t)%~).X.r.A...v.6.V.[....}...>.x.U.-..1<te...........K.WwF.....e$&>E*......mp.s..7n67m..]s...$.....+M-..Us.PR....u..]k.b..5p..U;.V................... E./Rq2......auS.....UU2_8...s...ap.#....H..s.P....\............z../...;.Ago8C..'..|...X..ZR.....GM...h.s..Z."....82...j....,V+..j..C...p..{......7...........}.9.p..<>..Y,...'...!....>.....F..j....5.42.3v..X.|.....e.[...+..JL.%...Iy..[.tw....j...H..3.9.e..4j5.f+\u.........CW.u....<.wp....{...^.p(H|.9.T0..p.............._(P.J.y....,..;..'.E.>.[.#.._...,QR.pY......-..w...ys.A<.@".(...D...a.J.{...d...@9Kd.m....;s|.>.<.B......g...@.%j...k.Q.<.G.a..{..|.O.@.h.I.x.n?%\.b..e.bx.WU..o.dRB,......_~..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tool_search.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 112 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3841
                                                                                                                                                                                      Entropy (8bit):7.936794890178898
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:EiU+SxOJqQDBX4FQYoxhTr/MWJThCI5dY/A7nSX2gKgQ6:EiU+SmXRhTrkWJThc/62
                                                                                                                                                                                      MD5:387BA64C9F45FEEF2E10A7ECEE89CEC1
                                                                                                                                                                                      SHA1:FB01461E47D36CBE561BBEEBCCC8A514082C5001
                                                                                                                                                                                      SHA-256:6813B8D9C948189546C6A2455836E1A125CA9962C7890882473C55AD4B58B3AF
                                                                                                                                                                                      SHA-512:31E2B9B5DBEFAA35B69B3F27890A11E6FB47DB346E79B3722ACAFBBE222A60CD7996B42E0DC56B75E6905EB41902FC5F9398CAD18809114FCDA29ED750365EB1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...p...........;j....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.P..u...d.....)...!.....$..L].r..{.i:.t:u..L3.&..N...t.I...T.*'...*....-...I...<..~.z..x..*c..&Wsf.....s.=.|.+.....8ZwZg{,!...I.$....^...*.9... ...K....}H|.#.u.O.T.k.S....'...d.d.d.4........w.$#$}$.HzI.H.$n..0dt.#~*..m.]F/....4....n.\ 9Nrhrb....Q.e...c...1.'...F..........<...E...#..M,.!/W.S...X...d.6evy7=.+.9....^.Y.#J..B.p,...$/.{eU.JK.....L.......Fm6.Zo...5...v..."CZ.i8.WTT......%.........uc|t.....w.....p<2..>!4.yj.uf.B.....:...P.......l.a.V(..G..;I.I&.7..=q!B..$.m6..:W.lAm}..r..n7...b...R..*.tz=..Lz.G...8{...SS[..|L.m6.;.[...>... ...`x:.22.......S'.011..........c.["..[..v....|..l.6t.5.._.QaL.1(....$.}..R..e.....p...D...9...A&.B...$....>v...nv...<..R]].{u..d...].........9.-..!t.^_..2.4.JD.Kz.[.q_}.]}m.>.~...Q..f.WH.)..Jz...y%...m..{...eu.....E&....`.B....q....h.*...Z..."....b..n....y"....m..<....F(.K.S..H......c..q..F..%<7.d...i<..........<...u.z

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360mwapp\skin\default\tool_sidebar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 136 x 28, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2980
                                                                                                                                                                                      Entropy (8bit):7.904587672083421
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:XVxfPDO/ZqAS1dE6lCxzZMG5of6V+QZ198lcenvmUL8e2UsJXk0nxGEngbdFJAt:XVxjQbwEACxzZMGN+QZ198m2NweCNxvP
                                                                                                                                                                                      MD5:E7FB4B50E574A0C6BCB91FF84A05CDDC
                                                                                                                                                                                      SHA1:71E7DE26218A926857D6D3F24F9A27FDB7627ED1
                                                                                                                                                                                      SHA-256:050AFEB2AB763D10D19031DF07F50E10C10A4A30EE969A9E755AEFB1FA4DB77D
                                                                                                                                                                                      SHA-512:F404316C768335C5F55EEAB567751975AD8C8253CAF78EE172FAF201F33790714E404F3028BB8C5316187492E035B938AE5C186023BDAF3D740A30ABDFFB8B5F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR..............M......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...6IDATx..[[l...>3.W...5fmc'`,.K1 s)...&..B..*.D..RHJ.PU)...O}h.P).MS).$/q...+..C..&...$P.16..efw..s.3fm.....HG3....7.|.._.1....#..a^.S.e!Jy.....Iv.\@9.6y.-..<...r<.q\.e.Vf2.P.....CL@...z...:.{......i.........)...+O.>}.0..W.P..],...v.~.....y...PVV.3f....8|.p .......P.r.,T.....-l...}.........Y..:...3....d....K]].a....QS...9..........3q...#G........h.j.6........O~....o..S..F..-H.RP..}..'....B..[.N...t:=l.>.......c...o...a..K.....4.....&...eY.h...=....s....r...q......_t/........../^>....f.....6...4..c....w. ..8..D.U.z..c.X....../.u/B............D..^|.y.....g(...,`. I.`...E......].$..;...q...O..Mi.S....H=.m.dy..W[0Z,B.e.0k+.?."....y....n9y.....K*}...Fxfs..psu.C.!....u]<y.M..]..Z ......b.*o5zs.F.E.r=F.......~av]]K......^..Q.k..As..s.... .w]:u.....42........X.|9,Y.......v....{.Bgg'.ji..?..B.|....g[..Z..n^..'?>............".. xp....yuuk.uu .SUU5..&.1.f}:

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\360wapp.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2055344
                                                                                                                                                                                      Entropy (8bit):6.501574992303422
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:7TmiYzj+x7bTWqC1QRmQ8KeIzHlyaZL3iY4AUrnGs/RLIHfs2lFfjErTztWCCwu:GiYQj5sIvFyeCZyHfs2Lfj8tW1l
                                                                                                                                                                                      MD5:2EF1EAA12A6DB2793C2981DAF6E5D885
                                                                                                                                                                                      SHA1:FBD587CF30AFC8CFCC6B579D31FD390E05E5A105
                                                                                                                                                                                      SHA-256:E0358A4AF7258EA9901120D18EDA96F027E879A72A9CB3E5AC3D9EA183916AC9
                                                                                                                                                                                      SHA-512:F9F0917DB1379032577D423674B69E796E9BB72144FC28DE5D86EDA473D8572E3ECF040DAF95CD20914C7E5F40387587A1DD060E632388AA82A4D5653A52748D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F...'...'...'...h...'..._...'...u...'..._..n'.......'.....'...'...%..._...'..._..,'...u...'..._...'..Rich.'..................PE..L.....Q............................T^............@.......................................@..................................A..|.......pJ...........B....... ..TG..@...................................@............................................text............................... ..`.rdata..............................@..@.data....V...p.......X..............@....rsrc...pJ.......L...h..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ACS.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25
                                                                                                                                                                                      Entropy (8bit):4.403856189774723
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1HGQlL6VTN4n:1llLwTN4n
                                                                                                                                                                                      MD5:904254B956A2CF34946D30A9FA5DF97B
                                                                                                                                                                                      SHA1:17C257F1E93395E68AAB4D177BA586A5DC426338
                                                                                                                                                                                      SHA-256:3692E135B0EDB2CA76E79E105A9F4E9ACFF4B41CC580446A00FEF659A3B28D7E
                                                                                                                                                                                      SHA-512:5D2136F6340F4F65735F7AD890D21764BAAE8C362EF8CA735B03CAB8C4921F1AC86A9757B36DD6FB482ADC40C71E303047508F05423DFB29B4E45045C77E41A8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[ACS_INIT]..main_switch=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppCenterCore.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1157120
                                                                                                                                                                                      Entropy (8bit):6.505465407208107
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:kMsqyPFCyyLIyN/VowTqLbz4nt9GIy9knbKHbgHmbq032Q7x720WNmrtYVhapjUI:pwPFIIy9uwV/NYsbsbqV0WMrtyDGD
                                                                                                                                                                                      MD5:3370C6FA90EFD8CA5C88E7DB8706247A
                                                                                                                                                                                      SHA1:1BA328300E3021DD1AF86C27E7E5A6436C4F1EDE
                                                                                                                                                                                      SHA-256:6D51C3DC16D1876CB4AC691BDB49C3D662F76C92F423BCBB1497B3D07AA831E8
                                                                                                                                                                                      SHA-512:E4328F0420807ECFE586E8BB597134C80BC107106BF41A5E35088706ADA545C89A81F199B88155BFA1EB30800DCDB80F9F2636458C03CA67942EFBEF30624A25
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E............................#............V..&......&...............n.......................Rich...................PE..L......P...........!................sw..............................................6W....@......................... :..v...l...................................X...0...............................H...@............................................text...L........................... ..`.rdata...J.......L..................@..@.data........@...n...*..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppCenterWnd.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2192
                                                                                                                                                                                      Entropy (8bit):7.696154582427948
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Bg9ABsVEiS+zQrXKKzSPszXKK1n74jfWCOKKmKKUKK6pKK6HKK6UCcZYcKKZCZ4:Bg9ABsVM+EOVPsW+MrNq87k7q7J3BZ4
                                                                                                                                                                                      MD5:E51B0AD4BFC77B1E98775CF5FDF56956
                                                                                                                                                                                      SHA1:3CB8DE0A8115A22F7EF2155420934BD95D34400E
                                                                                                                                                                                      SHA-256:780D2BF0844667CD12126B77CF7B2966E8DA44316AB0EAD26FC05784D25F6F2A
                                                                                                                                                                                      SHA-512:7E7197C107521703B3CEAD715202423E1CCAE23D2052C46198CB141D08F52E71CE50004DD8D15799575981FA43E5FD7BDE5331151336D78AE4E57009F7834205
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.W..^N...S.......Ql."......[.W.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp......fL..v4g.HkJ...w.'JN]".......(9....I.-.%.....k.V..!c..L.h(.Dm'..B....c.....?...kc0{=..^@Zj./.<.uC.=]./.......{i..@Z..E.|.J...y..6M..r..._./...+.&.Pk..iO.9b.h..C..4..}...\.F`.@7.......=]./.......{i..@Z..E.|.J...y..6M..r..._./......D..m.....=.+.../..H.M[+ 2...E../...1..N.-p.....p...o&.h4<w..r.W.....~....Uq..Y.$Z..O;/o.....D.".U{....J.#b.e.@Qj.Sc.1.r@d..;..*hy.....b:s....q.l.;.J..K_../.wT/...&.`.K.........g..wf7.1.0$.".....3.c.p..0a5...3.|...[.uJ. "..h..{.....L.T....I..*w..C.Gp....u.....ErRO.c....D..".Z(^.!Q.M]cs..he;e...O.~..:V.~.4.....~...6..h..En.d.9.yp.Z9b.].........]..A,(......}P.a.....W.....~....Uq..Y.$Z..O;/o.....7......q;.......V...2.AP<n....W.o..+..JE...?.....,]..C.Gp....g .M.gihRO.c....D..".Z(^.!Q.M]c..6...5. .......Fa9.... ..l..xN

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppCenterWndChildren.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1160
                                                                                                                                                                                      Entropy (8bit):7.766703141550728
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9+GxKRJHk1nRlmXZ7DmIn1h7sJ9XluLJHa4xGKMCAjdaKKRb3Yi:Bg9+eY2FTmXF712FuLJHmCAaKKR7X
                                                                                                                                                                                      MD5:92E0EF9260687512D940A54C6714B457
                                                                                                                                                                                      SHA1:CE3AE7C37EC9249B694E7DAEADD18C2CB372171D
                                                                                                                                                                                      SHA-256:913B06C4B35082FAC679D88CB2DB948CFED354883FBE3EEE5520B9F150D9D307
                                                                                                                                                                                      SHA-512:BBD345DAEE82960A8A9F4412FD52191F6A392688B431BFF255B6AB346A5DC116E4D0AFF1676E8A944EEA2BC6671839AB3911EF671357FB351FCFEE6DC34E011A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L...D7...5.#...,.....Ql."......[.W.|...[.uJ. "..h..{......M....lH.l...|p.Fa9.........L.....e&.......x|...?M.gz.cw$..t...k..,W..sR#...t..........T. f.+.]..#Ns~.j.@...o3.X.y&l.V..R.'@T.n...-#3...|%k.{....(.u.K..O,Vt..g...u.."...B@....k.X......I`......'d.}._.t. df...X".V...2.APOF{.?2a.^.!Q.M]c.H..P...+..t...&.ub....P..s.b.]/.,..<;...Ij.N.......g....L...`...#?..P:......*hy....@...wT/...&.`.K.........g...u.Q.....{..K~.F....`...j0z...".I.rQg..q1F.F...>..O...h....n...-#....T..t..3;.."....{/.._^.....S..^............n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE...?........C.Gp....n.>.SDZ.RO.c....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppCenterWndDisney.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1200
                                                                                                                                                                                      Entropy (8bit):7.774965102414142
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:t3x+9J/dCAn74vKiLwWj+qtX0IeFe2HCxTzk9idRzGCAjdaKKRb3Yi:Bg9Jd745FXheF5HgRCCAaKKR7X
                                                                                                                                                                                      MD5:3346BEBEB3D2A4D6439F47712318FACE
                                                                                                                                                                                      SHA1:D5694236FB3937566BD89B35625FB548A238CDCE
                                                                                                                                                                                      SHA-256:2B8946D35D5D16D2574B7B86FA81846EE8E663A3C53E37D854BFD5A0BE43C780
                                                                                                                                                                                      SHA-512:1505DC8134C4437FBC3D25308F83C2C08F0F87AFA2C867C85FDC9A93F1FE86C8CABA0349C8FE1E5924BAF0DFBD36552C39B3513C28F91687816A9EAC20635C1D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....7.QqR...f(..,!.3.#.....K..r......7=.X.8.......yuk8..$.rP4..w...b..BF..w.._e.a...5..(.....r.K~......W...?T.....,%...z...L.7.e)..5....=.=.l..../....(T....&.e....l....{i..@Z..E.|.J...y..6M..r..._./...........U.d...g..\..O.....U..JT....I.qs;.7./..|d\./g.iC..u.........V./..^.k.~..qh.......V..'t".(.%..3#...*.Y..5..Q._..G.\C..h..Ens.O|.z..Y.$Z..O..B.......F......C.F....Br|.w.......a.$..JP.J..h.B(..a=`6.{.R.V..R.'@T.n...-#3...|%k.{....(.u.K.....(...j...m.XD@.Nn.wi....~......5.\..JO...<...~.*x3.,c.....k.^/.....X~z.V...2.AP<n....W.o..+..JE...?...-j.X..!~..y..tKV|;J.....;1..xV-/.s"|uAA`.@...r..i.J....,..W.....h..Ens.O|.z..Y.$Z..O..B....O....Z..+........_...../....X..........n...-#....T..t..3;.."....{/z..?E..Q.B.Q.&&^..Y.G.l..|...[.uJ. "..h..{....q...CU.8)...._a..\..O........l.}.wT/...&.`.K.........g.....r,.:V.~.4....hK..Di..h..En.d.9.yp.Z9b.]..............uT.....}P L.\6HO.W.....~....Uq..Y.$Z..O;/o.....O..%.6..6..[m?..V...2.AP<n....W.o..+..JE

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppSCProc.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [ForbidSC]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                      Entropy (8bit):4.8565074817223515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:LP+2c1+4rxAmOy0VHRIS+MmJQHB3ls6+ImdH6A+Th+/mWWtBxjH6kAIP8a2FU:K2c1hrxA00VHRISFGQh3ls6RWH6A+ThH
                                                                                                                                                                                      MD5:18ACE6E9985EB6F0CFCDCD8431E5D920
                                                                                                                                                                                      SHA1:A9B9D3C0293E8C08BA23115645B4B92DA4ED491E
                                                                                                                                                                                      SHA-256:4B027B37BF2A1F7DF106D637D4F55FFB178664193500C4112A1174E371F2AC07
                                                                                                                                                                                      SHA-512:AE96BD7ABF7A1C371E58BF7BD193F611C6CDEA318948A58779866BF0BCA922471C380072FB84275407F3343B8DEBED989A0DF573757CB9A42C76506446C9CB3A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[NeedCopySC]..ACDSee 10=..CorelDRAW X4=..EffeTech HTTP Sniffer=..HttpSpy=..RSD Lite=..Skype=..Safari=..Microsoft Office Word 2003=..Microsoft Office Publisher 2003=..Microsoft Office PowerPoint 2003=..Microsoft Office Outlook 2003=..Microsoft Office InfoPath 2003=..Microsoft Office Excel 2003=..Microsoft Office Access 2003=..Microsoft Office Visio 2003=..Word 2003=..Publisher 2003=..PowerPoint 2003=..Outlook 2003=..InfoPath 2003=..Excel 2003=..Access 2003=..Visio 2003=..Microsoft Office Access 2007=..Microsoft Office Excel 2007=..Microsoft Office InfoPath 2007=..Microsoft Office PowerPoint 2007=..Microsoft Office Publisher 2007=..Microsoft Office Word 2007=..Microsoft Office Outlook 2007=..Microsoft Office Visio 2007=..Microsoft Office Access 2010=..Microsoft Office Excel 2010=..Microsoft Office InfoPath 2010=..Microsoft Office PowerPoint 2010=..Microsoft Office Publisher 2010=..Microsoft Office Word 2010=..Microsoft Office Outlook 2010=..Microsoft Office Visio 2010=..Microsoft Office

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppUpdate.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):209864
                                                                                                                                                                                      Entropy (8bit):6.5024107808001474
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:CA1daG2oc26b4J+kxQLuUWyEefSut5GgzLhsbeOjunR5+hGv7drG:Pd92oczb4lx5VydfSut5UBSnCwrG
                                                                                                                                                                                      MD5:4041E2D714BB833F85C49BD952DB8D70
                                                                                                                                                                                      SHA1:4BA4D999FF511D5295B5CD3DC6A83F55442C595A
                                                                                                                                                                                      SHA-256:B7E10B3B16A7E10CBE310C2213268467E63D2B50E1CC54754976CB1B020B28FF
                                                                                                                                                                                      SHA-512:AADD060D0BF73969CAF0F985FF8895BBA530E3968A0AC53D12C890466840ABE7A241E120F2BDBDEA23BBD62C36584419CA86A910C9A1508C07C892AEA1592B02
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b...b...b.......b......tb.......b......b......b...b..\b.......b.......b...0...b.......b..Rich.b..........PE..L......P...........!.....T...........Q.......p............................................@.................................d...d....0.......................@.......r..................................@............p..(............................text....S.......T.................. ..`.rdata...e...p...f...X..............@..@.data...\C.......&..................@....rsrc........0......................@..@.reloc..h1...@...2..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\AppcenterData.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):665448
                                                                                                                                                                                      Entropy (8bit):6.307152211676421
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:8ewM5egdD0nHwv1KDs4fU3Sd5H+pscGKsyClZ9Q17:H9TdDicDYepsJKsBQ17
                                                                                                                                                                                      MD5:2C6A3D174572D20AD836EA64CE31EFC6
                                                                                                                                                                                      SHA1:9CB1D008A248E6806D5548DD960B66C68CDE0BC2
                                                                                                                                                                                      SHA-256:C4DF348797791A91A3ECF05D1375CDEB26188B4273F794041A67A2FF4D50783A
                                                                                                                                                                                      SHA-512:85A1619C5458239044EEA9E4C56B129350CA4D7E844FD74648BFAA18705F8055E1A01FB34280746E3587092F2A72632B922683EB37BF0D7D7C8E7DD964F2709B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}=J.9\$.9\$.9\$...I.8\$.'...<\$....8\$.0$.. \$.0$..\$.0$..v\$..._.6\$.9\%..\$.0$...\$.0$..8\$.'...8\$.0$..8\$.Rich9\$.........PE..L...uz.P...........!.........v...............................................p......a.....@.............................................................h........W..P........................-......p-..@............................................text............................... ..`.rdata...5.......6..................@..@.data...XG.......&..................@....tls....I....@......................@....rsrc...............................@..@.reloc..8u.......v..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BizPluginCake.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):198104
                                                                                                                                                                                      Entropy (8bit):6.617352366925133
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:WRs3qPoZ5nmGk66yCXeyqv79VDNLcYHrwDzM5d5sv0oSDnzBTfn5D8Xjs8:NfsBqvJFe2rwHM5d5svFG97dijs8
                                                                                                                                                                                      MD5:1A069A853EF0B9547D10C9E55624BA23
                                                                                                                                                                                      SHA1:47FC9336E7DCAF28BF699AEA213E87CD8EB349C5
                                                                                                                                                                                      SHA-256:A9E66ADEC4C6910A9A569F3EC6FD40B415FA37AB395C09C679DFF84C0D01DEB8
                                                                                                                                                                                      SHA-512:6421533452420A19DA488C7E1B1D24F59E9BEE7B70FFD898B361758B4444E284E2549A38E7ECC8D455A6A4A673EFE41DB60A778BB8E9689582096087C5FBB2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.V...8...8...8......8.....8.... .8.<XC...8...9..8......8......8......8......8.Rich..8.........................PE..L.....[Q...........!.....<..........*........P...............................0............@.............................................................#...........R..................................@............P...............................text.../:.......<.................. ..`.rdata..OX...P...Z...@..............@..@.data....:..........................@....rsrc...............................@..@.reloc..|(.......*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BizPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):135
                                                                                                                                                                                      Entropy (8bit):4.63702248676012
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0HXvWb/ZHXvWb/YOvr+emnmL3LzWNlD/zWbK9i0HXvWby:OrzfHXObR3OblyFWONIbK9rHXOby
                                                                                                                                                                                      MD5:1CAE2763819664DEB155A198DBDBFE2F
                                                                                                                                                                                      SHA1:889A8EBE6C79023402B21B8D2F28CA6E875A4CE8
                                                                                                                                                                                      SHA-256:034AD00E526AB54D9E7875A73DEC35ECE3E02D2091796B58870589A44BD98B42
                                                                                                                                                                                      SHA-512:3D5C783D01038971EC7BE18BEF5627736EB4947DD553B4DE12DAE2F0DE5F581ABDCC562A4AF19D71FD88A51DACE821B166F71CCDB617AF8200A7CB57688F1F56
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopbussiness>...<bussiness>....<plugindll path="BizPluginCake.dll" bussinessid="2,4"/>...</bussiness>..</360desktopbussiness>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\BoxUI.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):894824
                                                                                                                                                                                      Entropy (8bit):6.52386078019351
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:FB/l9ImbX0RJsEZ1h5YC8kFjg4698fng+Ae8niUP6ZMlvj0+nduqpWTyEd7ml3:FFTgsU1YWEnEnJAloZMlr0vq4TRml3
                                                                                                                                                                                      MD5:8D42784F8758FFEAAECE44B131CD8C76
                                                                                                                                                                                      SHA1:455E4E7175EEA90C625EF99336856460DE77333F
                                                                                                                                                                                      SHA-256:378D1DAE7BA0C554F354586589F56FE818320C46537A1004475F902EC205B082
                                                                                                                                                                                      SHA-512:A5F659423112CA7C65DD8759C6C1E1DBB041F4DF9594FF0CB679652D03ACEEF17CC8CBAC7D2B9CAC749D6166B5AE74B0180BCCB82F323576669A19285C9AF7A5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................e.....e.....e............a.....w.u....p.g....p.....~......f.....`.....e...Rich..........PE..L...p..Q...........!................(........................................ ............@.........................0...N...<...@........S..............h.......\.......................................@.......................@....................text............................... ..`.rdata..~S.......T..................@..@.data............T..................@....rsrc....S.......T...>..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\CatchScreenTray.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):531400
                                                                                                                                                                                      Entropy (8bit):5.943047165437147
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:YAPBD8ItjByZ3JeByKzdA0CmWZyYNgHQ/E5g2HNnqOr7bg:YAPBD8ItjoeByQSMWZyYNgHnq21Zrng
                                                                                                                                                                                      MD5:5D769795FA0B32B7E7AAB82E6F87CEDE
                                                                                                                                                                                      SHA1:CF780D816C495758C0DDE8B96733C585D6269F84
                                                                                                                                                                                      SHA-256:74B38BFD569F1421F29BDB0D34F95ECE9442792376A337E45B98021CC4E5E37C
                                                                                                                                                                                      SHA-512:18A5BBA59FA14F1F6E772F6771E670BE9A1FC3581AC56E9444E2B56807D385F85F8FA663042CC61582C4B5E3C70AC76B43ED55A4C8185A46C45604265F543A17
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.QKe{?.e{?.e{?..4..d{?.l...{{?.B.Q.d{?.{)..a{?.l...C{?.l....{?.B.R.g{?.B.D.D{?.e{>..z?.l...;{?.{)..d{?.l...d{?.Riche{?.........PE..L......P............................qz.......0....@.................................Br..................................................\...........................06.................................@............0..t............................text...)........................... ..`.rdata.......0......................@..@.data...@........h..................@....rsrc...\............N..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\CloudTaskCenter_naive.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206656
                                                                                                                                                                                      Entropy (8bit):6.533353933032578
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:7pug/0vD2hdIdDNZ6oyY15afle0TK58x3lap:7pug/YKTAAoyE65la
                                                                                                                                                                                      MD5:BD0A2A0341F0C0CBE91ED912DCBB62EF
                                                                                                                                                                                      SHA1:7DDE8B27275CD93053D98EF3083B262A395FAFED
                                                                                                                                                                                      SHA-256:B4DFB4A0970548604908372F43783514D17C021C2AB65D5C12E61FB0B38C4B5D
                                                                                                                                                                                      SHA-512:AB390186B9190A29445BAC113636E9F613B3E4E2E77BF82406ADCF99EB1CCB10E1605C1D570A3522B15F1D723932F604E4422DB76749D57B7A9D635AA855593E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..k..k..k..,k..k..:k..k...k..k..k..k..=k..k..3k..k..+k..k..-k..k..(k..kRich..k................PE..L...F..Q...........!.....\...................p............................................@.........................`...........x.......................@...........Pr..............................H...@............p...............................text...7Z.......\.................. ..`.rdata..ZY...p...Z...`..............@..@.data...d...........................@....tls................................@....rsrc...............................@..@.reloc.../.......0..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Config\config_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Config\defaultskin_Bin\MiniUI_Bin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8726
                                                                                                                                                                                      Entropy (8bit):3.7443187790499883
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLo0YuVme76D2h9q
                                                                                                                                                                                      MD5:B870642CE161A91C270D9E176486964D
                                                                                                                                                                                      SHA1:25EB184565CC3756641DC879C6D058FFD757C3EF
                                                                                                                                                                                      SHA-256:A776DD81845A0001155310FF074C19EE147A53C3ACB9B4E1EC0FE0664BE8F573
                                                                                                                                                                                      SHA-512:55BF0EF9B2923C997C4D1ECA2A79272A737D2DC633CDA4567B6F6E0BA1C1C80AA975DD6586245D10D503E1E270DFCFB3109A6549A26E1E1965D798A4E49A4F66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Config\defaultskin_Bin\defaultskin_Bin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):206155
                                                                                                                                                                                      Entropy (8bit):7.724311656562767
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:JNl+gDqa3WIl9J5B8oOEyZ8dB+hDdg9rlY15nznAzrEDEc7IQTU8t+EeVqoZ9U:wgLWIS5EBUhW9rlYLLirwbR+NVq4G
                                                                                                                                                                                      MD5:37EB7D3070A76EFCA7B517B69D507F55
                                                                                                                                                                                      SHA1:D968B670149CC032A5CC84D3E61F10BABA87A8FA
                                                                                                                                                                                      SHA-256:2D995756AE4AFFBED0CB62A6CD65A6FCBD83215921B1BDCBE909B19C29A8C48E
                                                                                                                                                                                      SHA-512:BBB229089827EF79C1EEF2C0B256C2B5FFE2AFDAA674FE3C21668A5832106FC15D1100B8BE370B1D5B69FDE4A01DCDBB647EAF94621ED280B3687BCBF4172210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........'n.>..8.............ver.txt8.0.0.1PK.........'A................Common/PK.........S'A..6.............Common/360Safe-16new.png.PNG........IHDR................a....pHYs...#...#.x.?v....IDATx.].{L.g.._...6..k.:V.p[C._.]....H...w).*1.Cz._....4.[.3..d..".Y..\f2....\d@z..F....-...K..'O.......t.t2Vb.vP,.f1...D.+..l!..J...0V........lj'$#..>..}=9.....F{^.[l^.{l.K..m5>.gs..asw6........Y......[^.M..t..7.`.....;;...8.S?.......x...\.........zF..*.$.j.I.j.4../.._...o\..n....$...Y...Y>{l..?..?>w.gn....k..-*N...D..G(3|.s.....\...'._...?.p->.k....!v.6..]h...i@*..n..%.$vS........w/8.K. <.;......t/.....)..U.....'x.e=.. ..<..;....]vL.4.32.E....%.s.`hq...M ...."|?..}s$D...Q..G.Lp.....\..p\....a~.;sN...0r....|5....0|...@_..<...[..|...&<..........W.]...<...7.r.......`i......D...&'...j........g.pz..3>...R.v...#..y1\.B..n).6...IR..a.."...U`(5.3..0y..U?.......`.$.p{ ....7..........Dn].y.@.Z..m.*.h..'S.8[...L?....KM..;.M..Cy.`..Dq.XX..s...ixV^*.Ws..Z.!...K..".U\\.........-..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTCrashReport.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):253616
                                                                                                                                                                                      Entropy (8bit):6.269768372575183
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:Luf0V9jblulC9FT2saGG1VLErK2RaqOv+TBRjp3L:Hug9FT251Vz2cqOv+TdL
                                                                                                                                                                                      MD5:5DC6B9FBC85018A912A166C5B7C6515E
                                                                                                                                                                                      SHA1:51DE39B4CBAF5F704464EF43FD89099D96A540B4
                                                                                                                                                                                      SHA-256:BAF48D4858CF440C64A617EB6FB0DEC7FA821A7136DA9D89A2FDE43CF09EB95D
                                                                                                                                                                                      SHA-512:A4FB4EBD7E5DD00C3CDC86A0F11100623348E57218DC417D55F625FA0EDF144971E39B60A040684241F6F4FE13D68397AC8F47D251F677A1E3A51098A4235433
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xzq.xzq.xzq.q..lzq.q...zq.q...Ozq._...wzq.xzp..zq.q...fzq.f(.yzq.q..yzq.Richxzq.........PE..L....Y.Q.............................+.......0....@..........................0......@-....@.................................L........0..@............................2..................................@............0..<............................text...o........................... ..`.rdata..L....0......................@..@.data...@I.......,..................@....share....... ......................@....rsrc...@....0......................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTQuickInstProxy.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95608
                                                                                                                                                                                      Entropy (8bit):6.367483084267698
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:vLrdUPI24KL2zLaTRasZpLqCtQyZOUAkko5Rdj5IuwS5wCaD:vLrdUPI24KLbM0LAyZ1dj5Ic8D
                                                                                                                                                                                      MD5:9C25145409A526C663D25822A2B8201A
                                                                                                                                                                                      SHA1:4C22A4D2FF1450DC43503B161A44DC44499A4292
                                                                                                                                                                                      SHA-256:5EBAAF4478F9ACA39BE440E687FAB7614C1CB51DAF679EE0B89FF40EB741B825
                                                                                                                                                                                      SHA-512:78D6DE19AF8DF9862D0EDCE551334109A10F108D185596F8C36CC586F2CE9DC28D528888E153CC2D0F892A4B6D6A174BF693F2D39A1F7967ED440D54579EBA5C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..h...h...h......h.......h......h..J...h...i...h......h.......h.......h.Rich..h.........................PE..L....a<P.....................v......SY............@..................................?....@..................................+..P....................`..x........................................... ...@...............x............................text............................... ..`.rdata...3.......4..................@..@.data...`>...@..."..................@....rsrc................@..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DTShutdown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):240304
                                                                                                                                                                                      Entropy (8bit):6.486048784542187
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:pWmcumWKrd6V0v2QiDv3kGeeL75oe8D8lhSOXYox0n72FspCMX5CBaaaakcDCkqG:znalij3CHD8lhBotaF8CMchtqji
                                                                                                                                                                                      MD5:6F712FAAF9EDF362136780C25455B1DB
                                                                                                                                                                                      SHA1:1A968BC1596B0CDC1A4E795A2EA662848CF2331B
                                                                                                                                                                                      SHA-256:9A693E0A675BFB8A4713B7822FFC608CF6BA2D4441252039C619FE345AD57E3F
                                                                                                                                                                                      SHA-512:E5BF190D46219DCEE909CCD6EF46168268412BED4686B11AF06E211B56106158F7E57FC03572293E3BA7728DC55F3B3827836D091DF47589DC13C206451F6EC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<@..]..]..]..%..]..%...]..%..]...C.]...U.]..]/.\..%..]..%..].....]..%..]..Rich.]..........PE..L......Q...........!................................................................i.....@......................... 8..h.... ..................................8(......................................@...............D............................text............................... ..`.rdata..............................@..@.data....A...@...$...*..............@....rsrc................N..............@..@.reloc...:.......<...T..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DesktopSkin\360DesktopUi.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):351941
                                                                                                                                                                                      Entropy (8bit):7.9719161142134025
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:dMpaZWPAQlOHeEYCb06N30D+wFm02kMlPCAwv6HDfyNixZzZk23FMWTC:++M0YTT2kMov6HzyNixZe23Fm
                                                                                                                                                                                      MD5:FCDC836CFC2099FDD35E9A48443BA101
                                                                                                                                                                                      SHA1:4796AE3613D4BE04E803E7D9081596CA4CB34A98
                                                                                                                                                                                      SHA-256:CB97761340EE5CBDC741854152F73C6EAF3FF298207DC01140317F8F7E86E4E8
                                                                                                                                                                                      SHA-512:94CE599F1B6E0808EC3548976B8DE8E8986EFD8D233D2DF669A714EFA912E37AE3F4ACF83A62B66132A4865BE08AA79542883766B45A7BFA090976AD96428944
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@......03.Books.png.........PNG........IHDR...............S.....PLTEnnn...............................................xxx...^^^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................lg]..}d_V..xqka...........tRNS.........\|.bW0JX@:O.e.lekjdmc[U.LHCy^}|.~}szrxvnrNXio`][98ZASQO/MG(ErN|z8F>w9.tMD-.v{QtRJflLIcKGhDe^HFa@X_:F6V>2@0J<*Pl_[1${.]UTUuxRpjpS.EA?4=,:oVV.xP

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\DesktopSkin\MusicIeBrowser.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):98102
                                                                                                                                                                                      Entropy (8bit):7.987341497429232
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:tP9IcJxJpWSfIfchoOx9kKRdX/BkdqLEpVo7E2orroQfHoQtW23dYBbdlLPuokF:tVBna6IPCJkdqYpFfftW236ldZPuZF
                                                                                                                                                                                      MD5:54D7CF37CDA788FEF41397F5B9D81F11
                                                                                                                                                                                      SHA1:EA55C4B59714AD3BDF458DEA1777A3082980C5A8
                                                                                                                                                                                      SHA-256:9DACAD145A7037FA3A6E7337B20E7876BB49F9C34C9C9F9BE639811EBE8A7801
                                                                                                                                                                                      SHA-512:3B80DBAAC8E536F65281672690087152C48A631993AE2C0D3E3661FFEB349576BBA8576E08B3918671EAAFAE2115C6B8EA9EA08A4C6E05CB229C1C5859FE4210
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.......Controls.xml.....Y..x....-.q...>E._@1.f...c.f.h.....H..h.84.l....A..j.Y.d.. TVf...Z.....o>...w........{...?|...}........gv....su.b.e.Us...\Y?.'~...?....>n.]k&.0{h....%.........?~..?.?............o...C....z.1lo...om.....z............?...g...1..h.....bl%.Tv.{...o.....y...V.....U.....r...C....<..?...C.......7I...g.b.j6.....w?\.t...F...8K.&x_.........7..9..v4}m.#.RKO.....lK...._...X........s.{R...wc.......7.........O.............!s.0.q....B..Vk....._}......{...........]...R.W....?......O....../.t.5K..p..\3o.L..-...N.w_..go.bm..~s.+t.EMi..L1;..n..g.._-....J_n..g....\....l.....~.U.......%uc...H....e.rIc..)...qy..Xnw.c.~El..T.I#..{........?.)...g..e=.k..q.W...\..Rf(5d.zZ.j._...?../?&...f..$.....].{....R......?...R..Z.9......L}.*.k.q..?|..w........_.....s=k....W.r......Q<>/]........=f...b..6.^J[.9.H....g|.....O_.....u...a.]...*..............cfc..#..z..c(.Vsu.............r.BZ.O.?.m..;...............}......p.x.|Y.nN..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\FenceDistribution.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):916
                                                                                                                                                                                      Entropy (8bit):3.605738362004565
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+L5ScTi5AOtIulF5JferhjWyvQ8ljW6e+44+vn:rlTBuH5I9/Tm+/In
                                                                                                                                                                                      MD5:0C6CA411CD6353B82D2C17BEB9FFDDF1
                                                                                                                                                                                      SHA1:1815182E096A3D5E13CAA1769C0B5ADCB71943AB
                                                                                                                                                                                      SHA-256:000893B824CCB244DE6C8B5D77BF98A3187356BF8B8321B0566106E86BEA83C0
                                                                                                                                                                                      SHA-512:A71427A9B8F6347FEF1944EF58097EBB9A95B2C3700947B9DB2623A8DEAE7C4DBE92FCAFE628592C37F0315843E42B6013CCCC50D640182E3B2550E28D30EA39
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.d.i.s.t.r.i.b.u.t.i.o.n._.1.0.2.4.x.7.2.8.].....f.r.a.m.e._.n.o.=.1.,.2.,.3.,.4.....t.o.t.o.a.l.g.a.p.=.1.3.3.,.-.1.,.1.0.0.,.-.1.....i.t.e.m.g.a.p.x.=.2.0.....i.t.e.m.g.a.p.y.=.2.0.........[.f.r.a.m.e._.c.f.g._.1.].....n.a.m.e.=.._wc.e._....p.o.s.=.1.3.3.,.6.5.3.,.1.0.0.,.3.9.0.....t.y.p.e.=.s.h.o.r.t.c.u.t.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.2.].....n.a.m.e.=..e.N9Y....p.o.s.=.1.3.3.,.2.9.0.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.o.l.d.e.r.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.1.........[.f.r.a.m.e._.c.f.g._.3.].....n.a.m.e.=..e.N....p.o.s.=.3.1.0.,.6.5.3.,.4.1.0.,.7.0.0.....t.y.p.e.=.f.i.l.e.....n.e.x.t.l.e.f.t.f.l.g.=.1.....n.e.x.t.t.o.p.f.l.g.=.0.........[.f.r.a.m.e._.c.f.g._.4.].....n.a.m.e.=..b.v.N.v .....p.o.s.=.2.0.8.,.6.5.3.,.7.2.0.,.9.8.4.....t.y.p.e.=.n.e.t.d.i.s.k.....n.e.x.t.l.e.f.t.f.l.g.=.0.....n.e.x.t.t.o.p.f.l.g.=.0.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ImportFavHelper.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):716464
                                                                                                                                                                                      Entropy (8bit):6.887338423237583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:SXobqb7txh0BHw/dq70//Le71eBSlX4QwfgW3hFHOnNGzjuzG/SY0ekSkS2L:Wqe7oq014Sl/wV3/HONGfiG/US
                                                                                                                                                                                      MD5:01E6C6FD97BF4F23D3CD5BE9E4BE53DB
                                                                                                                                                                                      SHA1:F691E5EF40701BFEF9BD88FF50B46E2793772F8E
                                                                                                                                                                                      SHA-256:7FD2A1A53E3EEB2CF446C611BCE1DE50E26B6E46680520FFCD0465D04D9514E6
                                                                                                                                                                                      SHA-512:64C45D755EA64C9731A7D63E6AB5DE6ECAE6D55956B3EC0C0BABEA713C57E31139E4201974E6F2980703EA5B210D94BECDF04A54B647BB816480DB7A1192FDFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.Va$.82$.82$.82...2%.82-..28.82:..2 .82-..2..82-..2k.82..U2%.82..C2;.82$.92z.82-..2..82:..2%.82-..2%.82Rich$.82........................PE..L.....ZQ.................$..........o`.......@....@..................................r....@..................................S.......@..|........................K...D..................................@............@..@............................text....".......$.................. ..`.rdata...%...@...&...(..............@..@.data...(....p...>...N..............@....rsrc...|....@......................@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\10\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):320
                                                                                                                                                                                      Entropy (8bit):5.326804241243158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xMxVLKOSrPjnFXirPZNbUQ5l3nZKARTKRo0Le8MqcsNJs:2VLViRCrbd5VnZK0TKRNSsNy
                                                                                                                                                                                      MD5:54474DB3D028B1527B7259E6427F7DED
                                                                                                                                                                                      SHA1:CCB8D4866FFD17CF518BEF9E18FDD441DFCBD4CC
                                                                                                                                                                                      SHA-256:62A5F86D26164A133C033B8A09EF5137C73FB45A7EC4563EACD4B016C8351230
                                                                                                                                                                                      SHA-512:FDCDE8E131D79EBC4E93F0F8BBD41709ED4C8CF79A8BDCFAB57B9067B7855498E0BE4E3044C0C4BF3BA4CE9A141B00CA5646E06B23EAE1EA760CC8463A7A7E87
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=10..version=1.0.0.1001..name=........*............[AppSetting]..icon=logo.png..smicon=logo.ico..frame=1..title=........*............url=http://static.apc.360.cn/cms/skin_uploadwebapp.html..catch_img=back.png..width=760..height=480..timeout=10..fullscreen=0..rclick=0..max=0..vscroll=0..slideeffect=0..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\10\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9662
                                                                                                                                                                                      Entropy (8bit):6.561898688748442
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:sUcTe6rqKLcgvdeqz+Ql96HAyHX3LpCEqqNjllgPxxXJitQp:LKIgvAsl9IAynzqOLg/ZyQp
                                                                                                                                                                                      MD5:2CD835A7A37080E6407EECE713D94D85
                                                                                                                                                                                      SHA1:0B3C0DD404B8283649E297577A07D061B1E027C2
                                                                                                                                                                                      SHA-256:0573D5F151A829FE8795A1EFBE2B22CB50F70B52E674E628867F6C35578C1890
                                                                                                                                                                                      SHA-512:53DB5DD3CBFB899C3B308C15BD0657E724D60B29533EECFD90704A8D8EA99BAD4A7F9F3FFDE2CAF9F119E3B53C80C5260A96FD214423AE31335B97EC11BCFE41
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%......(...0...`..... ......%.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................a122.0/0./10.132.132.475.<>>.JKK.TWW.]__.dhh.gij.aee.[\].QRR.FIH.;<;.465.344.376.585.698....Z....................................................................................................bcd.^``._`b.]a`.^bc.rss.............................................chf.bec.bgc.efe.ffe....w........................................................................................................................')+.........................................UTU....#....... ... ...'..............................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\10\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1018
                                                                                                                                                                                      Entropy (8bit):7.745716050054846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:GiTESGwxRqlt1m830H8v5DbpT53H/+kkz6iqR0:ZYSGwnqiH8lbpT53H2kNhG
                                                                                                                                                                                      MD5:463682E0470747EA57EC16831288666E
                                                                                                                                                                                      SHA1:E2FD1968489B79A5B63401AAD5D76C7ECE216D61
                                                                                                                                                                                      SHA-256:073286DCD12BAB82FE98695C9BA2C477B1C3D693BBD269D49F1930E1D92F3F34
                                                                                                                                                                                      SHA-512:A849D00B70AA8F8FB89D6E93F3E3AFC68996094EC450AE40DD19C643EBCC657FD14EE40B6548FEBA9F64FACDF43C0C10D36F17918FB1DE9589E9B41F4F6D1969
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.LQmlSe.~......u.vm7........9...H.1.E.Y.....]L4..'...C..?..%.,.".b`a1X...8$..c.]m{...{{.....'99'.9..9.]!?V.h.V)..]....J..x...Nr.6.Z..:...jU..0e.y...=.'.....O(..w.X.s.9.$Q.../.o..J.2l.....~..^\9SB..X......~.m.L...n.r.sD....'q..eX.....v.j...o.O=v...2,..~[..< z.8.9..*..=..!AAS[.....^..;?.....a\.K..<.........,....Ss.QS..2X...,.........8...7m.D..G$hS..%..............j..!.P#..-Bc*...C.M.'....."....;. [...I..s....y!.|.X.@..A..\)".0...W...p..;d..^d.f..5.]D..........g.kz..OO/....c...16..i.e+.r.J.4.+),]..3.....`.f3.~.iC.{'}o...E..A-"rZ.L...VM.{|....SJ.H..N.!...Jr...YY.j.D.....`......\.R"./.'.a3....J..N&h..,...#...........Z..@X..k...B4.AJ:....fE.U5.V.E.7@b.&..ws.7.f7PX....f..^o..m....Y.9##..X.C#.D0..[ g.=.{...NW...a....&7D.EV..s......!..@,.G4~.J&.Px.(N.<..L.........#{..[o.P...<`.w.. ...........B..y?l7|.....,.x...#G...`....8.+.{.y.b..R...P...=..ZW).N....Ee...o.........T.p...$.W...a.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\404.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):581
                                                                                                                                                                                      Entropy (8bit):5.671194366055472
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:h4QW3tL6QcjWR0NNEXW0YWtRIkT4BkQiE4mT/qzRWh0M8pcPUvSsmNTAXaWmkoz9:hPg96QclfoxdGL8pccvSsmZ2bc16+AGb
                                                                                                                                                                                      MD5:F14655D20C6A0F8F7689556EEDC6EC78
                                                                                                                                                                                      SHA1:687EEA25A387F769FF4F276A44932373E0C18D21
                                                                                                                                                                                      SHA-256:4BC05D51F81F548FEE56744D979AEB3782691F3172AFDBD7E9880A8C9AFF0551
                                                                                                                                                                                      SHA-512:D4138FEE06B99C317B50EE13B4E921D17F84D357BA9EC595B352195156D4255E23A39A67D5FD59FBA75DABF59C9B54867522AA21C5CB5D6491AC0D7D0BA91D40
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta name="Keywords" content="......" />..<meta name="Description" content="......" />..<title>......</title>..<link href="style.css" rel="stylesheet" type="text/css">..</head>..<body>..<div class="bg404">...<p>............................</p>...<a href="#" onclick="window.external.wappCheckNet();" class="icon-1">........</a>...<a href="#" onclick="window.external.wappGoCurrentAppPath();" class="icon-2">.......</a>..</div> end bg404-->....</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):268
                                                                                                                                                                                      Entropy (8bit):5.016387560591547
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x/XWVLAcVnT6NbUQ59KKY/JdstJUqW0JOLeRM3uV:JWVLAcN6bd59KKY/JutJQWsuV
                                                                                                                                                                                      MD5:11153E7A49AC28AA0F6A5BC13B4155FF
                                                                                                                                                                                      SHA1:4641F591FD8E31C8B00B231FA79B2700EC7A87CF
                                                                                                                                                                                      SHA-256:3BC6D68B3423D29CB03D5CEC8E4FA2262D4A7DBAFC020A68520B8EA3A0E573BC
                                                                                                                                                                                      SHA-512:14AC8011A89E86FEC6D24AA5DEF28AA616E49E6447C74E428A59D73BD894E7C36EAB9D2D89171E6C663D1536F6631B4431FCEA5791B2E3C7AF802A30893C2F1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=12..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/selected.html..catch_img=back.jpg..width=780..height=508..frame=1..rclick=0..timeout=10..dialog=1..errorpage=404.html....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\img\bg404.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 779x480, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14335
                                                                                                                                                                                      Entropy (8bit):6.92934378343167
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:7UpzlnERXDNZSzCA8h+uSp5cbSfbHwjzVsZGq/Slh1XOQuytQZ4z:qh0XxZSzCt+v5ISbHov5OQM4z
                                                                                                                                                                                      MD5:FAF8B6385FD7F996E95F05BD1F835895
                                                                                                                                                                                      SHA1:DF57708B207CE7C482ACFE33898DF3CF12344B15
                                                                                                                                                                                      SHA-256:611C3EBA62899A3A033CF9C0E120794E676EE574E161BB9CF35CFD02C47BCF96
                                                                                                                                                                                      SHA-512:064F591A8DC156802867460D34D1B0B4887707227E83E5D693B1209911E18A205BA80DC6994DC876D217CD096935CE8C94790EFF0A068674B1D09186F105A3D9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......F.....)http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5684837B8A2111E1BE88852A1E825E74" xmpMM:DocumentID="xmp.did:5684837C8A2111E1BE88852A1E825E74"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:568483798A2111E1BE88852A1E825E74" stRef:documentID="xmp.did:5684837A8A2111E1BE88852A1E825E74"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\img\icon1.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 15 x 15, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1427
                                                                                                                                                                                      Entropy (8bit):6.7017778396309815
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:e/1hpunQWwjx82lY2T32HEV/jdryJ3V/gKPcGc/drFnu9I63Wd7FTpt2STg9:eNitNn2VpZmJ3xgMc9dZnu99+pt2STg9
                                                                                                                                                                                      MD5:3F70A66B5656E9B98EAB16B97AF4DCF1
                                                                                                                                                                                      SHA1:FF8371FCE8A94F339A005E50EE56A94DBE6D34F3
                                                                                                                                                                                      SHA-256:F554B18F74C318F1C83E0C83FB7C0EFDE426C96742FF4FCA788030FBDB690D32
                                                                                                                                                                                      SHA-512:0963755D42F563463D182BA4342E632C0AB4F901ABBFF5AFBA528F4B11736CB745432850B2DAED4F649305E6203310ACE3A3B4F270440A3190393D6C80A780E7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............ex....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:85E7192B8A2111E19C57D1488CDA6081" xmpMM:DocumentID="xmp.did:85E7192C8A2111E19C57D1488CDA6081"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:85E719298A2111E19C57D1488CDA6081" stRef:documentID="xmp.did:85E7192A8A2111E19C57D1488CDA6081"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8.......PLTE...{{{................................zzz.........|||..................888.....///..................mmm555BB

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\img\icon2.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 15 x 16, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1341
                                                                                                                                                                                      Entropy (8bit):6.660314282726688
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:D1hpunQWwjx82lY2T32HEVC4paKmFj8yJ3V+ZscKojGhL4zO/mnZ1D6I4Q:JitNn2VPpqFrJ3EZsiju4z+mnPmI4Q
                                                                                                                                                                                      MD5:022049480A6EEA22446A57B2B48D6BC7
                                                                                                                                                                                      SHA1:3385B067F1E663C28F777A96AE5957A7B574E9C5
                                                                                                                                                                                      SHA-256:388A11AF4D1B8EDD9A3B4B0180A7FED9CF02B8F45385FCFFD4051C3D64CA146F
                                                                                                                                                                                      SHA-512:81038C586AC241C120B00301B5DC744AFE90B059BD69600E90F140B3CB32693FEE68F312934262D3FAC3B4537E7B45D9D44520EEA3855DD674F30175AC9602CF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................6....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B4CBF35B8A2111E1BC3FAD68A8934BD7" xmpMM:DocumentID="xmp.did:B4CBF35C8A2111E1BC3FAD68A8934BD7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B4CBF3598A2111E1BC3FAD68A8934BD7" stRef:documentID="xmp.did:B4CBF35A8A2111E1BC3FAD68A8934BD7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...U....PLTE....................................aaa....................................................|||qqq@@@.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\img\star.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 71 x 30, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1460
                                                                                                                                                                                      Entropy (8bit):6.710870562337673
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Uu1hpunQWwjx82lY2T32HEVL6oyJ3V8qGAHgHUu6BmiPDM1r+5Ckz:U0itNn2VwrJ3HnUt6BnPDe+5dz
                                                                                                                                                                                      MD5:7094A805F02511F487BBB62E46730610
                                                                                                                                                                                      SHA1:AD83885F1146A009925539715C2D944007990CF5
                                                                                                                                                                                      SHA-256:2142EBCE84866039D63B991E0CAE2AE7A4DA7BB7A6696A9AA0C27970204F21E8
                                                                                                                                                                                      SHA-512:A875C83E8FDDE33C1DF7310B4F840995C0FEFE493C4AEE42F462FF34C3A04A53F2134389CAAC2219C3F8FCAAE367F36DAE37D2D7403EC06D5D3CDC20B832A59D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...G.........I.......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D469F9978A0711E1A913CE9E06B5EE48" xmpMM:DocumentID="xmp.did:D469F9988A0711E1A913CE9E06B5EE48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D469F9958A0711E1A913CE9E06B5EE48" stRef:documentID="xmp.did:D469F9968A0711E1A913CE9E06B5EE48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...o....PLTE............xxx...uuu......}}}PPP........MMMzzz.....yt"{{{<3*..ooo..dddFFFJJJ...UUU~n"ttttd ___.....TTT.r

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):4.853209632444685
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:KDnYX6EGZ5XQV9WR6ZYL6GV5Er+QasB6l3Jrl2ABWgAtcYMEycxOwA4Au:KDnSdG0rWRB6GhUBIZRASYMQOlw
                                                                                                                                                                                      MD5:77224A930D612CFA147269F5BBD2B2AE
                                                                                                                                                                                      SHA1:4A199B46F400E43B8D92EB1347421486B7D2582E
                                                                                                                                                                                      SHA-256:818BAE51AFDC6AB53F20962AC7333DE7ACA75B441D0C3D393E03E0B5E1DFF938
                                                                                                                                                                                      SHA-512:C141B1F74C2F38B10A9B759BF21805E2E9AA925781599199F3F558C950EEEEAB1BDC13027524DD3C635044C7A6D005D848D835CF700C9ADBA1FD977721341297
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ........................................................................................................................................................................................................................!...;...K...H...:...)...........................................................................................................?...e...|.......p...Z...D...0... .............................................................k.;.k.i.k. ...................4..._.I2..^8..1.............y...l.6b..J...9i<.................................................k.}....&....u...k..g.K.......&...K......`...r...Q..k?..P6..)9..0U..Fq..\...U....8#.............................................l..W...Y...J...6....z...a...?sz..._%dQ.>...7..%....v...[..nC..ue.#cp.'[...Y...F.a.............................................l..b...l...M...F...C...2....^...=o.:...L..4..,..)..%.......f...S..rQ..hp..Kve.............................................m..b......._...D.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):773
                                                                                                                                                                                      Entropy (8bit):7.695863552306289
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:37MFMYOphpgl8jMKuU7mTOSGvo6Ge8SU3ax:37YMXgDjQD8SLx
                                                                                                                                                                                      MD5:C6D64D2E656C4B4BAB740F9B2E6BA71F
                                                                                                                                                                                      SHA1:03930A6FC25F5509049DEBB5375CFFA29393057C
                                                                                                                                                                                      SHA-256:6F4E916D0D8A96AFCE535FB2C72872CE85D4DAFFA230CFF432E64BD3FD92706E
                                                                                                                                                                                      SHA-512:1523890264AAFA976A9214533B58697B88F807568B690023C32C4835828B28DF85EA397F2A529717C991341A74B89D917C6D89F8CA15E2BD0DEA98B05B493153
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMHTQ......S.F..tt....$EJ.Z$..D.h..p.").........m.Z."p..pQYi......4...y....)$..{..~.........l....J..V>.V........W...a.../..e...sc..S.66...............90w.e.{...o.Lj..r..k%4K.>.oW.!.K.....u..R........&..-f...@.fZ.y.!..+a..`.1XF.|L.l+8i.+..R..$B:.....!..=.._y..=..,/....E.`....#P...Z0....|z..O..E....E .,.:....^0*#...#._...T...*.'.o+.^....wW...PN.2..4 A...d2...l....q\.<.C(..4..\..N}g..{*v.J..=.S...h>..'Z....R...#.....Wml..X'..........^.ee!.d./......rQI..Zg.....J..].K...]&A]Fd..1-...u...:Nz. q.j..T..@.:..}...|....gmm.....6..mc..F...@Q]$.d0?3......U>......o..}...a:..."[Al..V..G.:DX|.|.W..L.y.ISYB./Rl.s...w.r.p.m ..m.i3]...W).1ddH....0.<.&..mV!....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\12\style.css

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2834
                                                                                                                                                                                      Entropy (8bit):5.217757716871249
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:hAyEm4LVV2K+cxaxVvZt67x3aYM+j6AK5:hzETL72+wvZYx37Ms6A0
                                                                                                                                                                                      MD5:DF8ACFDCBAAC70E85A66F54AD5A7CD28
                                                                                                                                                                                      SHA1:48A82D1BAEA5458F328AA5FA91FA130DEC38B86B
                                                                                                                                                                                      SHA-256:DC8C5BBF0CE53259F05D78EED3C7E389C78ED8F35EAE8184F5364824375DACBD
                                                                                                                                                                                      SHA-512:686B80F9D58EBE22CC7C1C6FDAFB1BD7976B9BED194E9D184844DBA3D42A9B94195DB8EBA6D49828A97368F12461637866C2E7734AE10BD82B7313860FDA121C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:/*Reset*/..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0;}..body,button,input,textarea{font:14px/1.5 Tahoma,Helvetica,Arial,'......',sans-serif;}..ol,ul{list-style:none;}..h1,h2,h3,h4,h5,h6{font-size:100%;}..fieldset,img{border:0;vertical-align:top;}..table{border-collapse:collapse;border-spacing:0;}..address,caption,cite,code,dfn,em,th,var{font-weight:normal;font-style:normal;}..a{text-decoration:none;cursor:pointer;color:#fff;outline:none;}..a:hover{text-decoration:none;color:#fff;}..body{color:#fff;background:#2e2e2e;}...wrap,.bg404{ width:780px; height:481px; background:url(img/bg.jpg) no-repeat; margin:0 auto;}../*cover*/...cover{ float:left; width:310px; height:437px; overflow:hidden; margin:27px 0 0 18px; position:relative; display:inline;}...cover p{ padding:0 15px; height:82px; background:url(img/txtbg.png) no-repeat; position:absolute; bottom:0; left:0; _bottom:-1px; _background:#000; _filter:alpha(opacit

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\13\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                      Entropy (8bit):5.042940971137794
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xfmVLzGtZVnLJsNbUQ5TkHJKKY/HXVgXhXW0JOLe/sK:kVLStZVubd5TzKY/6XgWuK
                                                                                                                                                                                      MD5:76BCFEB0BFB8B6BD8CEC28854FC4D42B
                                                                                                                                                                                      SHA1:76AFA2BBA001887D10839624142FECFE61CEAB4D
                                                                                                                                                                                      SHA-256:459231F45A31166C2E5B623A28B6D2AF95385ADFDE2E8B273FABC7BC9DDB442F
                                                                                                                                                                                      SHA-512:60ABB38C8C3319DECD8C1742AD2501584B24479761A4F88FD6454300677B3DB5D601D03D8699F2689B662D1159AAFB5C5D4A6FEC4ADCD384FF7FCEE7C981742B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=102395759..version=1.0.0.1006..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/video/shipinhezi1.html..catch_img=back.jpg..width=920..height=700..frame=1..rclick=0..timeout=10..dialog=1..max=0..vscroll=0..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\13\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):5.282838979968636
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:T4a8bQsPGZYKQ36wejgyzSy+oYV+DMxZC5e1aaK6Ath2BcRy:TX80sP9Yl+/VlDcet6h2Ww
                                                                                                                                                                                      MD5:C01D51842DAEE8580974E01879B235E3
                                                                                                                                                                                      SHA1:70FBF395BE53B5AC089CE4D9EC253F49046EEA12
                                                                                                                                                                                      SHA-256:7B062943DA7C2D5C5E327E280174AF39832FFB9C0DFDA4B54567980CD8E42663
                                                                                                                                                                                      SHA-512:B5CC629A8F96F35DBEDC7A1DFC6AAFF743C739F395F294A1311F19E7C01CCB5EEE557DC5DE2C5C58B518F86479754E8A4A5034A6FEB2DCC69B306F2051454002
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ................................iLLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL.LLL....T........LLL.VVV.ZZZ.\\\.___.baa.edd.hgg.kjj.nmm.qpp.tss.vuu.xww.zyy.{zz.|{{.|{{.{zz.yxx.wvv.trr.poo.lkk.hgg.dcc.`__.\[[.VUU.LLL.........LLL.XXX.vvv.xxx.zzz.|{{.~~~.........................................................................~}}.{zz.xww.YXX.LLL.........LLL.XXX.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...M...M...O....v...r..=..V...Q...O...M...M...M...M...M...M...M...M...M..AAD.YXX.LLL.........LLL.XXX.AAD..M...M...M...M...M...M...O

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\13\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):440
                                                                                                                                                                                      Entropy (8bit):7.086005302182458
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72PGibjgYpQXmngdL75VfLfT+bmhPtN:qsv5gR5VfTk4z
                                                                                                                                                                                      MD5:B9092CE8A3E15D256B74F3D613FDC3A3
                                                                                                                                                                                      SHA1:AED3236B71F433E2711401DA6BE0DEB71BCE388A
                                                                                                                                                                                      SHA-256:53690FBF4331D52E27306439966B46A592EFAA673E51A4F230A40C6385F1BCB8
                                                                                                                                                                                      SHA-512:05D1BF69CC149906706298FD4486FAD200451D32D37005FA9437328423FAFC9BE42A520B978250F0D241F900B4E3EDEC1B55456C553513F5C61CF5EF5832876B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b...f...._.2.....DDD.122...I.....A.0.y.FK[[.a...(&.0>..'.........G......M.+....+..G..QQQ '1...0|.......D......U...@.aaa.....u.........w.^......L..l.@.......4>.....Y.........$G!.77.%.,0....(...2L\.......^...L..dbD..2......j2T..E.Q..........7...3L..a...@.#......+....0|....<N....>c.C......n...j..-...2..L...(. #3...>(/P.....xk.f..#.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\14\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 800 x 600, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42976
                                                                                                                                                                                      Entropy (8bit):7.976986096657465
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:JY8DOTs0tZu86QOBlrpSYZFOS7TW1jzoouQQObUTQHd9W:JnaI0tY86QOBhpqgyX9uQQO8id9W
                                                                                                                                                                                      MD5:44F6139324A0D5BE1FEFC6AF9CFF9BF3
                                                                                                                                                                                      SHA1:F564C49D243B598B6230F823E894A22C99AC6E30
                                                                                                                                                                                      SHA-256:401FD43380FB9AE94E5E3D0C7C3FA5F663952AE1FFBA9F01EB019922B1EA9794
                                                                                                                                                                                      SHA-512:AA302CA47AD77CCB566A57B19DE784FEFDA0241D36986CEBD19850F170ED7B1B8DEAF18D57ABE9FBBB8F871C5F1EC36C0BC96DA6249A95397E4A893EAA97E82F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR... ...X........'....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Y.%.u&V....nt7z#6B$@6(...H...5.=...F.....c".`{.:.~..!..m.~....$...o.....8#*$....!)......l. ......o...T....Yu.O.V....2O...2.,t...?v....A.P.UPw....{...(.!..j.]...Zd......e..Bgh..]...#V=.Pd<D.y....._..(;Z.(.f....-.M.GJT..U..p{.p.p...%........."..&{'.....6.....B............0...S*h;(8..w..V.c....,..N..]c.......b......Z.E.>@...L.ou..2..T.[W.jg..`a:....A'.....o{.'.P.;...c..=&.k-..zk^... X@#sG.>..F...tK.<]S;.@...ddu..1.. c...z..u..>.o.....5O.......U`.].0dn.7.....$../...f..0k....wB.o.`.,.%4.(.....fE&e..e.i.1.......].....B....N....z...<....+..K.HE+5...D.V...s.7@..i.TW.Y.#.......f......@......In....n.A...w.s..M.Q.~.kx..nr._..b;...V.v..)"_8n....V..h{.p}!.`.F...S.ik.Hn.7_T\.5M4..=.g....N...1..xb.l.W`.....T...[.tX.......tB!W.. X+.g....V.,z/Y..2.aUZ....*..eb.a.t..4._.p.}.V.d.i..+yq......m...ZU+o...._..L......lgm.v........t..L...mh.}......o*o..T.:l3... .(...E..:.?d......B...6..f..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\14\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):257
                                                                                                                                                                                      Entropy (8bit):5.037816982032033
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xkouWVLVS1VnTkNNbUQ5WKCW5MKAX8VXW0JOLe8:iodVLVS1JQbd5zMK88UWG
                                                                                                                                                                                      MD5:1AC97EB96E408FCA59220829D5F359DD
                                                                                                                                                                                      SHA1:58839DE61AA3112519C29E69CEE87AD73D53555F
                                                                                                                                                                                      SHA-256:A6A1580CA87A12E35774A2FA67A9DFCD6EDF905E7512C55D591EA10E66DC52DE
                                                                                                                                                                                      SHA-512:D06127BCAB88EF19ED0C686219AF684AC552462661E399815E4E2863A1E74A5F2F3F695967EBA8F1B62409620937347AA7AB92EE67578F6AEF2C74326BB69882
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=102395754..version=1.0.0.1004..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/music/tingyinyue.html..catch_img=back.png..width=800..height=600..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\14\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):3.2550150789181798
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:kOsvGVoyywlkyy+PNkFl34XCXBq2kRMbZ1IIIIIIIIIIIID76rNU:kOKGVPPu54XCR8cGU
                                                                                                                                                                                      MD5:77F7A0EC343EB8863C600A7DF658C29A
                                                                                                                                                                                      SHA1:622E65827F7E0B1549811F884D0A5515D63B83F6
                                                                                                                                                                                      SHA-256:B330B7064CD9A60146C6C18048A26E14642B4143E50F8173DFA0BFBB55628509
                                                                                                                                                                                      SHA-512:3B41E06C47329D386C7CC959BD84166D619B16C91D2939615C5C3E43BF26B7DB3759B9DA7E0539DFE5D48FA08C745A62F40A2C19F8370FE1D266A51DA1195F7F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................................................................1.H.}7...@. .M...@..}7..1.H.................................................................................................}8. .N. .N. .N. .N. .N. .N. .N...:......................................P$u..?. .N. .N...?..P$u.............................e.. .O. .O. .O. .O. .O. .O. .O. .O. .O..j0...............................@. .O. .O. .O. .O. .O. .O...@...........................H.#.V.$.\.%.^.$.\.#.V.!.O.!.O.!.O.!.O...J..........................t3.!.O.!.O.!.O.!.O.!.O.!.O.!.O.!.O..l0..................... .R.'.g.).q.*.u.).q.'.g.$.Z.!.P.!.P.!.P.!.P.........................!.R.$.].%._.$.].#.W.!.P.!.P.!.P.!.P...J......................t=.+.z./..1../..+.z.'.h.#.W.!.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\14\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                      Entropy (8bit):7.410199232361714
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72QMpFzl013hVoss5uA8IFvxYU1I6FHrtoGAWh3:kMpFmGsm8IEUC6NtDh3
                                                                                                                                                                                      MD5:9832AD31BB85BB3F6ED4A91F1758C968
                                                                                                                                                                                      SHA1:5A78759E3A544619A60FF123450D7ECEB7ED9A12
                                                                                                                                                                                      SHA-256:F64147F2D5DAE7DFB98776F24C45D4021329B6C264AE7308845C9F5DFC2631A0
                                                                                                                                                                                      SHA-512:500659B62217099F29639D68BA391B51AFA62B216326E5E17BFE7C612AA62C964C2DB4A312507411087E9A16372469965C256BCE5F2D20B093E4AF376E006228
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.S;K.A......`....m..(..ZX....m,m........A.....&.H@%j ..<..s...u.pr&..t.c.....%B..........._.........@.T.Q..X<.]..<f*g(.V...+@%"{e*K...2........n..%f.m(P1...t.`...!............_.4..9.X..G0....h...z..\N.....o...T:h..u.......M....m;h2...mg..+...6.l....8.....U......Ay9U2.....=..."......g.tD:^}eT/...{.1 ..&.}a.{.S`.~TI...!..`_$.SY..].......&.........C.<....^{..;5M.Jf.C.o#..s...&_.[p...?......../W..V....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000094\Loading.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2012:09:26 14:27:43], progressive, precision 8, 717x671, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):16051
                                                                                                                                                                                      Entropy (8bit):6.383750878137176
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:Vncibwy4Mjk8cirkn6JrYNMtKwrwLZS37ONYxdYmz1f2/TF51:VfH3/An6JrYNg7O4L1xdHix51
                                                                                                                                                                                      MD5:EA53BE66F4F8D34176779A2DECB17306
                                                                                                                                                                                      SHA1:AA20C6B8B45919CA45E9149A2787A46C2F4B1BD3
                                                                                                                                                                                      SHA-256:FA2BA962CB670DA5ECD43312311C21BC493311B923468A214705DFAD4349F1AB
                                                                                                                                                                                      SHA-512:5AB92127797CB510148C10E2B87A104C803806CE7CF7F683B0CD2F1450DDE4120471E8861C3272B701031E1B9961654FEE4B43E1B85F7B99FB00EAFC60D7BD9D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.....`Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2012:09:26 14:27:43...................................................................................&.(.................................*.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%?....I$...I%)$.IJI$.R.O.B4.Y$.%J..I$...I%)$.IJI$.S....I$...I%)$.IJR.0S

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000094\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):310
                                                                                                                                                                                      Entropy (8bit):5.107261797814054
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x82RcVLwSSVnGSDNNbUQ5joLD/MKpjJJLkn5LwvNzALwvW0LWERSyBStp:u2cVLwSSsSzbd5ULDEKp1Jk5UAbCSp
                                                                                                                                                                                      MD5:792BE06C777E7289AA7743B3578EDFD8
                                                                                                                                                                                      SHA1:102EB6C07CA71042345FC0E887F0DE1E59F293CE
                                                                                                                                                                                      SHA-256:012199A9362834D304C490A4B87D306064994B45ED569DC904FA9719E96CDA57
                                                                                                                                                                                      SHA-512:60A0E7538168CD5243CB16ADFB11D84949B3621C27D91F6548EB0E34A77C66A4DD5149521FE52201295BEACE09954D72526279D033508A34EF2509DE6FCB3CFE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=40000094..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/theme/index.html..catch_img=Loading.jpg..width=717..height=671..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..hide_share=1..dialog=1..NewWindowInIE=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000094\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5430
                                                                                                                                                                                      Entropy (8bit):5.1820953247333605
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:MHUxOezcKDm7oTao7H5I/prMC+B9jmvn0SLBl+Qg4:qHkcKDP5kpot/jS0Us4
                                                                                                                                                                                      MD5:447FEEE2F8BDA18A8FF699841D0B73D5
                                                                                                                                                                                      SHA1:385C69F412FCC9F3A6979D4B0BC786C51B1C15C9
                                                                                                                                                                                      SHA-256:9A0BBAB5E672AC9365F56BDF5C0FA4FAF69DCF80D08F0A7C8B622A72FA7540A2
                                                                                                                                                                                      SHA-512:F4D6261CF727DEFF62D861053C6C8AA0D17283A0224D86859A325FDEDE36E3C1182FC4BC0B6504CBCD6027DE370A66EB156D4F2756E53D68D60C0BBE134A7C28
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:............ .h...&... .... .........(....... ..... ......................................................................................................{..XGV.R@O.N<L.L=K.^Ai.b=~.Y7..M5t.E6^.........................s=o.C0B.Q9P..\...l...N...;..h1..W1..E3...........................i.........|...e...K...=..~3..U1..SC...........................o..^..a..r...W...L...;...*...3..l^..............................X..E..?..h..\...:...+...'...y.............................k.N...D..C...F..A..kl..,...&.............................s..m....M...@...F..D..<..nE..)........~...P........j..................y....N..F..@...0..c=..(...#... .....8....M.3..............................N..8..r&..OP...........~...W..S.c.".8.[.....*...8...A...>...M......._....q:..6r..&....~......}..Z.n./.d.,.Y...U...a...b...I...i...w....~E..R..R.....8...........-....O...Q.f.g.Q]j.Jk..Jl............{...............................u{...4F=.p.z.....QaY.V.........:......................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000094\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3577
                                                                                                                                                                                      Entropy (8bit):7.896644078371665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xYEIm73V60+:bSHIIHUCD4waL73V/+
                                                                                                                                                                                      MD5:B12E3D6ACEBED86F40DFB4C894D24138
                                                                                                                                                                                      SHA1:2768BCCD2F8ECF62BCD166CDEA53D5105B927C63
                                                                                                                                                                                      SHA-256:72BD130D287CA9BC222BF22006CA9C7776838A664A3B8EAD5B061A6461F5C06A
                                                                                                                                                                                      SHA-512:43506981ECB1ED3C3AD2C280777079E93EB7719F8A4A74688E2FCCB171850B9F2C31E218644E6C43A59A1A70C2F47B3490ED0EA0635D35975A6EFB9101AFCCBE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000096\back.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000096\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):612
                                                                                                                                                                                      Entropy (8bit):3.6663718902587106
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYGLw4ulti8PTpKAAtpKD9v4AK5D+HKvmQSHQB5HlblYZl6Ya8DsvuZhSaK:Q+JvYGLRiZdKAAbKD9vNK5qKvmm5jYep
                                                                                                                                                                                      MD5:8F18E366986CD33BB13293ED9D344882
                                                                                                                                                                                      SHA1:366133D1827B26FEC851004CFE0634F103F4F8C4
                                                                                                                                                                                      SHA-256:0DDD3DFBE21D1D412A630A8CF10484A8F5C41758E86CE4F02BEF0EFDCCC2856A
                                                                                                                                                                                      SHA-512:AA48EBA535DBFD267892FC37BD5973624D2F0EED14D7A272F121F6BC19DEA9386EDDC7563D7A6B88F3397C773F4C308D7FC759CB85592202115DCFD7FF30B4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.6.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.*N.N-N._ ..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=.*N.N-N._....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.9.6.0.....h.e.i.g.h.t.=.5.5.3.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000096\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000096\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):622
                                                                                                                                                                                      Entropy (8bit):7.566184431026209
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72r1s52jrOZBaFZgFnx5fCBOkOKtlZcT14kdqwJ7eNKyWZvsYSXmOT:31fuZMFZsx0BL3cqsnyWZvs/7T
                                                                                                                                                                                      MD5:56AEE1C86D6256F465815579E5AD516D
                                                                                                                                                                                      SHA1:6CF2FF2084E5695440F4C73A027545C2DE2CB533
                                                                                                                                                                                      SHA-256:45AB4386467F1C6C692138C7352767F45AB341BA985CE0BAE3B685F0350E53AF
                                                                                                                                                                                      SHA-512:BD304991D7EBAD9181ACD2C84FB32618E7BE35A69F1CF94289D2257F191917B6F43C9E68754E9D2102F31E86D380FDF4E58B29046EE543941F7BBEFAE35B7EE3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..[o.0......nTm..RW.(H..T.....<...PT.^..V....ffr.E.,9J....7...r..@.?.s..s..hMS./#7....W<.na.F.F.....U.0...D....A...j.i.......dWk-..rl.~ .$..1]E'.&...']...z..x;?......Il..m..0.......e.-89ONLHpv<...}C...b!,,....i.8....f.....~......B..+zHy..o....#...x.X...y.....).'"....j....=.....N.~.<R...A...O..4T.(..F..Z.G.._s,.V.C........;......6...0e..9fG.l...F....F....w.....ShX.C*.....W.s...=/PQ..Kk.4Mq:5.ay... .6c..m..S.E*".M..`.!..^.O....= Nf..>..?'...{....8.....I..,H...r..$.......:...r.+.....eg...C.L..\.K....J6........IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000097\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):258
                                                                                                                                                                                      Entropy (8bit):4.932198833574818
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x82xVLBHVnza/MKpjUeTVetLKwvNzALwvW0LWgvJv:u6VLdYEKpYeTstLLAbW
                                                                                                                                                                                      MD5:CACD252CC23EC905A63DD8DC315219DE
                                                                                                                                                                                      SHA1:34550B2838A26B8EA7301A5D1BDBEB9A16EC2782
                                                                                                                                                                                      SHA-256:2FBAB88911F57D850191D2D76D612B41FFF7233026BB2AB96FC9A1AC0177A66D
                                                                                                                                                                                      SHA-512:12F309EC5333628583516DCF0F57C871A3DB8175F7C4F84A23488060B776BD75BBB6E6E6AC4D8516106BDA02F013A046474B38F7C6A9FD6CAF352771B39D60F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=40000097..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=index.html..catch_img=Loading.png..width=360..height=207..timeout=5..frame=1..timeout=5..rclick=0..vscroll=0..dialog=1..checkurl=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000097\index.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                      Entropy (8bit):5.4660632914667096
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPO9kQDbu7SGOL8orwtzzrdgCN0/oa3GCK6TqSByA+iY/PQEfjxvnfjL07THT8:hP8Z2jOwJtzP7ittHTdeiY/hfjNfjET8
                                                                                                                                                                                      MD5:D94F9DFD6BE72C13357CD4312E29CF2A
                                                                                                                                                                                      SHA1:E72A49B866693FF8F779161149D61424EDFFA85A
                                                                                                                                                                                      SHA-256:2FF30F56322FA11D365FF77998E7B3982E5869BCB7B01254828C8814DDBECA55
                                                                                                                                                                                      SHA-512:D4D76B4A49CCB21AFAE413FE07214F7CA2CAFCFB9929A27FF5E0260C14E80FE08C31FE6150B57D5FFAEA5C62461AAFA7B48B90FD0CAFBCD05385446F861BEC2A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html dir="ltr" lang="zh-CN">..<head>..<meta charset="UTF-8" />..<title>....</title>..<link rel="stylesheet" href="http://s0.qhimg.com/st.360.cn/;bk_up;style/7e995a0e.css" />..<meta name="description" content="" />..</head>..<body>..<div id="doc">...<div id="bd">....<table width="100%">.....<tr>......<td height="107"><p>"<script>document.write(external.wappGetSystemInfo("updatetitle"));</script>" ..............</p></td>.....</tr>....</table>...</div>...<div id="ft">....<div class="progress">.....<div class="val" style="width:60%;"></div>....</div>....<div class="btns">.....<ul class="clearfix">......<li class="s0"><a href="#" onclick="window.external.wappAppUpdate(1)"></a></li>......<li class="s1"><a href="#" onclick="window.external.wappAppUpdate(2)"></a></li>.....</ul>....</div>...</div>..</div>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000097\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):5.771957875255846
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:jp6KKO3yO7ywawYVfm4mdOKNUs7h3UrlOu4N:d6KKAyO7kNBPmdOs7VR
                                                                                                                                                                                      MD5:1D22424FADEDB67A208EBDE8276A3C0C
                                                                                                                                                                                      SHA1:C483FC5522B1F9940F75498C3A9AC5C6A7F0A83E
                                                                                                                                                                                      SHA-256:F44FC1421467014EAC29E31066C33BFD4D6E7526C2E6222837DA7669E956C2D2
                                                                                                                                                                                      SHA-512:9141DAA941F534636B9538E3B4A705DD54A008825408CBD96147BAEED04D4EDD48889485BDC5391CF18509A48BF8B9A3D91BBFB9E0872FC223332B4537FC044A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%..K'...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000097\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):850
                                                                                                                                                                                      Entropy (8bit):7.609811882129263
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:n0gD0BgZzVm/Wuf/c7CqKYPpVZ5jewEAQ26Nozw9:nfm/kChuHn16qk9
                                                                                                                                                                                      MD5:0F4BA1A40C2EA13A402470EB81C8C59D
                                                                                                                                                                                      SHA1:CCCE59BC5713AE2859611EFD1D030059CA09F3F8
                                                                                                                                                                                      SHA-256:B1307EA4979EB106609D48A429641E9AD125BA8B7F8DCF2E46815DF3F83E2364
                                                                                                                                                                                      SHA-512:0EF7CD9B7CEDFF638BD02BFB07FD7AF133D23E32CDD42693FCE5968AAA23C81D35BD0B46949DA562B166D3C152F5E8E4117326785CDD7C851E5D9A84A787866B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tIME.....+.Q.?.....tEXtSoftware.GLDPNG ver 3.4q.......tpNGGLD3....J.).....gAMA......a.....IDATx...{HSq....cZ...X..cj.....V.. ..P.J.%0....J.L.a.D..f(..9..AR..)...;.,.nS.......\~...Kd?W..~6u".`.hn.(..p$.......T.Dw.....#.A...}.'C|.E{..01..4..*P..95s....x..\..?....$I9.<.~.7.C.&....kb3.1.........~.....C...|(.]i;..:...k.5.$..k$!.q@...0o-.....O...Y..{=.,.rj.../-.g...m.T<@t...*8...3....gx=.1-.k..5.zP..+RGQ...B....x..p..p#.!...@.jcM_`..vn.*..$...@........e...C.{..._.`~.K.7L.@tW(.....m.....E.,.....T.....@.g.c...&.A..Cl..R.-.T.<....X...-y...C....i....".'.......:2.W.<.;f`.%..._.?M.`......a.....ks.:7@.f..6.X.K.0...30..c..&L....J1.z..6....0.].J...n..H..x<...c....4...$.5g....y".p..:.....Y.......+..X.n.Zg+L...P..R....0*.&.q..;`..._....d...Z.:9...%X,....6...?.Lo....\N..3M.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000098\back.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 102 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                      Entropy (8bit):7.15988116972599
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7vVsAyj16JOCyNh+gBadPJL5WY4iYXEXB3NejqZdFBQVHjQVHkQVHkUwIGVq:0HyBoO1oDRtYEBTFCOZmvVq
                                                                                                                                                                                      MD5:B5343D747124509B687D572712C3148F
                                                                                                                                                                                      SHA1:62377B3E59064AA9BBAEB2D22851335311E746E5
                                                                                                                                                                                      SHA-256:0D8801DD8FE91190B39DF43AD5CFDBA8126363D7EE24DF576ED01CF75E40E1AA
                                                                                                                                                                                      SHA-512:63C5E62523FDCD4BA81CF7CB25AB6C14D724E336FC9A2E532DAED79C661B4C7DD3B74ADDF238C1278FE484B9023CA80E16187E0401800FBB387AEF13CD630134
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...f.........f)YF....IDATx^..jSQ....VI..5..899.L.|.g.,NB.n}.!s....'.J......j,....%...T..S.......wNOR.....9.8..5.y...".".n.......h}}.U........S........t:..@W.a..z.....q.Lb.b..8.Z1.b.....[[[w......n...{...S.........>.cs0.<..~....:...,RJ...X...x9?..N.#....9......ZJ.Eu...SB.;.G0`....|JH...1r.....I7F.....@......^..#0....t....Yx..cRJ5l.r.gecT:..l........z....4./..H.8.....8........(..;.Y)....E......Z..1eo.;&.(.&W..(/.1%..s|..yF9...R..Z.i.y....y.+-m..`..L.@9...R@.........#0`.........#0..F`.......0..F`.......0.#0`.........#0..F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`.........#0`.F`.......0..F`.......0.#0`......).L..*.d....V...c&u.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000098\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):620
                                                                                                                                                                                      Entropy (8bit):3.72647716480673
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:Q+i/avYu/LwDeGti8PTpKAAtpKD9v4Avr+HKvmQSHQB5HlblYZl6Ya8DoDvZhSaK:Q+JvYu/LGeGZdKAAbKD9vNqKvmm5jYe4
                                                                                                                                                                                      MD5:5E8605184EA5C11692EA7C7BADCC9605
                                                                                                                                                                                      SHA1:97C4A0F2E615896AEC01A8B639FFF7D19D3E2E4C
                                                                                                                                                                                      SHA-256:0B50ABD35242ED5AC75BAF159BBF4E3273BFA9B8F9B33E5DDD0CDC13DFB119A2
                                                                                                                                                                                      SHA-512:A979EA89016B61E31787C476FA1C9998CAE4E87BD6976371666145DF822A75EC11E8AB42C15CC39BE772280D6FBB4C7B525E8543A75F68E984C3F1D5395171C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.i.n.f.o.]. .....i.d.=.4.0.0.0.0.0.9.8.....v.e.r.s.i.o.n.=.1...0...0...1.0.0.0.....n.a.m.e.=.3.6.0..[hQLhb..... .....[.A.p.p.S.e.t.t.i.n.g.]. .....i.c.o.n.=.l.o.g.o...p.n.g. .....s.m.i.c.o.n.=.l.o.g.o...i.c.o. .....t.i.t.l.e.=..N.e.f.^..R....u.r.l.=.h.t.t.p.:././.p.r.o.f.i.l.e...o.p.e.n.a.p.i...3.6.0...c.n./.u.s.e.r./.i.n.f.o...h.t.m.l.?.u.n.=.d.o.c.k.b.a.r.@.b.u.g...c.o.m.&.v.e.r.=.2...5...0...1.0.7.0.#.s.u.b.=.1.....c.a.t.c.h._.i.m.g.=.b.a.c.k...j.p.g. .....w.i.d.t.h.=.6.3.0.....h.e.i.g.h.t.=.4.8.6.....f.r.a.m.e.=.1.....r.c.l.i.c.k.=.0.....t.i.m.e.o.u.t.=.1.....d.i.a.l.o.g.=.1.....v.s.c.r.o.l.l.=.1.........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000098\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):6.631924571015197
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:jSnZcun+bvWCQ0NSxZdWoGtvH7/lF9PjZgBr3DPmRkLT4z:uZX+bk9WoUflNEr3zmRu+
                                                                                                                                                                                      MD5:2A5907C09D75152D099621F1D40D7A04
                                                                                                                                                                                      SHA1:779D93041CD0DBED5DEA3E4B4D315081FEAF586F
                                                                                                                                                                                      SHA-256:ED874B0C638C1B4517A5E9EE21EFDD75DDD0F33CD6B2458F49C42333237778F8
                                                                                                                                                                                      SHA-512:017B60B926D0B6AFB85C18EE2EDE125064754BFFB4E8A4A0460FEF88913DE3FD78F40E80CFDAC993F1AF8A945E8C35A71BFB426862E94BB278BC9D437AF87769
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6......... .h....%.. .... .....F*..(...0...`..... ......%................................F0..F...H..I..L..N..N..R..T..U..X..Z..\.._..a..c..e..g..h..h..g..g..g..h..f..e..c..b.._..\..Z..V..T..S..P..N..L..I..H..G..F...F0......................Eg..F..I...K...K...L...M...M...O...P...R...U...W...Y...Z...\...]...`...b...a...a...b...b...b...`...`..._...]...\...Y...W...V...S...Q...P...N...M...L...J...J...I...I...G..Gh..............Gh..G...J...L...L...M...M...O...O...P...Q...Q...T...V...W...X...Y...Z...\...\...]...^...^...^...^...\...\...[...Z...Y...X...V...U...T...R...Q...P...N...N...N...M...M...L...K...J...Hh......H-..H..K...L...N...N...O...P...Q...R...T...T...U...V...W...X...Y...Y...Z...Z...Y...W...Y...Y...X...X...X...W...Y...Z...Y...Y...W...V...V...U...U...T...S...Q...P...P...O...N...M...M...J..J...I...K...N...P...P...Q...T...U..!V..!W.. W.."Z.."Z.."Z..#\.."[..!\..![...Y.. Z..$e..'i..(g..)k..)k..)k..&l..%i..!`...Y.. Z..![.."[.."Z..#

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\40000098\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1791
                                                                                                                                                                                      Entropy (8bit):7.282304314952082
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:QWHNn2qJXfIJ3JVJUkijyl8B5/UTvLoV5Gm:lt2GPsVJUk7M/vGm
                                                                                                                                                                                      MD5:0C20581BF63BBD796E3D0B4B21BA9C76
                                                                                                                                                                                      SHA1:8AE895DEE318A5F13D0647C289DD92DAB97010DE
                                                                                                                                                                                      SHA-256:7782439597273E15F56453C0E20AA444F94E10845EECA9F5185ACDD5E03CCD22
                                                                                                                                                                                      SHA-512:FC5D085F45B9D028614CB072C9C0D8AF6D7F25881CA79699927604F2CA7FB701AF9A671797EEE63115302B53D47014BF393BB127A79239162A8F607EC0D99C8C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7877C08B225511E2811BAB4F0B0366DE" xmpMM:DocumentID="xmp.did:7877C08C225511E2811BAB4F0B0366DE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7877C089225511E2811BAB4F0B0366DE" stRef:documentID="xmp.did:7877C08A225511E2811BAB4F0B0366DE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.`X....}IDATx...Kh\U.....{g.Lf:yL..6.I5.....E"]....T.W.V.A.Eu..#X\....Bh.h.VP...6)I.XC.4...$.d.7s..}zz.p.8....O.l03.h.JuD#Z.(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41000017\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):263
                                                                                                                                                                                      Entropy (8bit):5.059450475202175
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xrmVLl9ySVnFyDNNbUQ5/UyRZRMKY/JXmBgRXW0JOLe8:1mVLl0Sezbd5syRZ+KY/JXmVWG
                                                                                                                                                                                      MD5:7F9B5752950F1B4FBE18F1D413078179
                                                                                                                                                                                      SHA1:E2ADF90F718E886C0C46B0DADA852351E494D82B
                                                                                                                                                                                      SHA-256:29A569803B2DFC63B96D0177E4824BFDED2EA9B176E779D47C3ECACAE35323F8
                                                                                                                                                                                      SHA-512:A3E7F55CB9544F2CFB86F68402FDFDB10A2BDBEB323ABD1DE83E7D2B5FAC12380CD5B276FFF6A2E66FC131D7F811EA01B42E0141643DCC5A0B027DBD0DA22684
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41000017..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/ertong/ertongleyuan.html..catch_img=back.jpg..width=724..height=512..frame=1..rclick=0..timeout=10..dialog=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41000017\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):5.272865555733899
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:YiWvOO6OOOOOOVdMHgggggeIK333P33333333wHHHH8HHHHHHHHB+cDXfchshfcS:vcOO6OOOOOOLMHgggggeIK333P33333P
                                                                                                                                                                                      MD5:FA4C0871F09256E78A8572E0465BC1ED
                                                                                                                                                                                      SHA1:FC79A4B2F9CDD30F34859B8008E9C00AC25BC7B2
                                                                                                                                                                                      SHA-256:34C607A83BB9E1A3B152DB6C8ABDF5B6495032FC18B6EFF35EE1C435CE756591
                                                                                                                                                                                      SHA-512:EAF558A1CDA73C57A3E546BEA105A08B4ED7D7B035DF8C2A089023973C0338B2B49E4B722C0B7FE93A42954F93220E59C754858956282724ADEEC1576153056D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................y .l..j..j..j..j..l..n..r..v...y...z...z...z...z..v..r..p..m..j..j..j..j..i...r..iC..........................C..A..B..B..B..B..B..D..F..M..O..N..N..N..N..N..H..E..B..B..B..B..B..B..;...\.........................[...W...X...X...X...X...X...X...X..._...\...X...X...X...[...c...X...X...X...X...X...X...X...X...X...z...........................>...'...)...)...)...(...(...(...(...........}...M...z...........(...(...(...(...(...(...(...(...(...f...........................F.../...0...1...1...1...1...1...1....@.....b.....d..z...&.1...1...1...1...1...1...1...1...1...l...........................C.......1...0...1.../.../.../.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41000017\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):616
                                                                                                                                                                                      Entropy (8bit):7.530477633466423
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/72rokRmxkKU4RWmbiGIL9HXQFqsPxMRQhK9aebj8idjW:3okMkgqv2m/bhjW
                                                                                                                                                                                      MD5:5CED58E294927112F3AFCAB5B3F65B84
                                                                                                                                                                                      SHA1:EE8C0D989018997F7E7E8A3C8275A2C65DC9CF70
                                                                                                                                                                                      SHA-256:E92FCB0FF36E4B879719DC86C041A0976C8233214CAA87A3C9523580D6F163FE
                                                                                                                                                                                      SHA-512:76BE2FAC5893C5F04F70032CA7C82EBCD7207291D34D68243FCE752D9039587F97E27D16BF7E43C9DBD9384EED18BEDD514D054FA85077F06D10152BA076DAE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.SMLSA......`.6.*.#....HB=..I9....r..s....$..../..C..W!.J.R.1........U1...By..;.{.%..F;.dfgg..fv.....C..~......._...S...4R.3..s.Z`.._p..p.b=k~...j..v3.2.|.}5.q .W1...3......,..as..........=k....^...e....&+i.A..i..".k..4Q&......~...5.....2Pu..#*{....D..Q$...*...e..U..l......;...P8H..T..2 ..a.X.#....d`...bL.I.Sr=.I(,.....(e......Z...pAn4v.V.....;.U......4..N#.e+.....)x.g......].8I.X..-c....Od4......k.....V.#. T.B0..H.)B.@*...umO:...v}.....f...p...........a).FU...\...ln....U..P>|<H.+y..o...y..}...K....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010001\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010001\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):317
                                                                                                                                                                                      Entropy (8bit):4.935266667855842
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xEVVLhraVngYtrpNbUQ5nrD0oMKAX8VXzALysqcs57Jwyn:4VLhW+03bd5mK88FA7srt
                                                                                                                                                                                      MD5:FB13058ECC9F1005547A1C11DF46628A
                                                                                                                                                                                      SHA1:68B173CE3001210495879BB466DF942100C638F3
                                                                                                                                                                                      SHA-256:0EE7BA429BC05BAE10A5B86410215361A9A191939DDD8094E85B2CE6D72A88B8
                                                                                                                                                                                      SHA-512:23AEBF934F36FF1A3297FBE4D306F2C35FC1E6CA4884142E5B8E37A5801B0750A79FE8B9E01992FF5FAE19A6390E170595F12A194D669372824B6E4D448485BB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010001..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/social.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010001\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.1467555087668435
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/aKppe79frIPm+ZqhcTxFFFhp05qnU684m1eyPxakpDJnyC:icqfrICcT7U684msKakjH
                                                                                                                                                                                      MD5:A4934622B853F2D0558B8810E0C24446
                                                                                                                                                                                      SHA1:42662FC3F946988969854932471C79381C5E57AD
                                                                                                                                                                                      SHA-256:B993933B9225C5476FA687F8F4A1D08465F3D198C36B761B10B76F58CE0E4FAD
                                                                                                                                                                                      SHA-512:C5D1724DDEA8BE0882DD55B0E1FA61EE8DFE10A65CB838D2888156F9DAE6F2DDF7D6C58A6A3B4C0C337D86B1E7A9CE1483C32FEE6F7EDAC9D34554C431166C0A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................be^5hn_\io`Xio`Yjq`Xkr`XGo`XCoaX.haY.haY.iaX.jaY.kaY.laY.laY.j`Y.iaY.n`Y.e`Y.W`X.]`X.X`X.I_X.X`X.l`Y.L_X.:^..........................:...:...;...8...9..'@..+F..5N..;T..@Z..B_..Ca..Cb..Cb..B_..@\..:R..6M..2H..0C..*9..'7..)6..(0..&4...........................3..0M..0M..,H..!5...0...2..#9..(<..+A..&A..$@...J...H..-H..'C...;..&>..%9..$6...0..."...-..)C..*C..,F...!...................... 4..0M..-K..9N....y.w|..x.........S.....hq..fm........M...z.go..T[........K...{.ou..Zb....v.LM..#B..)@...!......................$9..1M..-L..5K.............................................................................WW.. =..'@...&.....................(%<..0L...M..-D.............................................................................."4(.(C..-H.........................2&=../L..-L..=R..............................................................................!5'.*F..*D...0.....................=(@..0L..$?..4>...............

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010001\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1719
                                                                                                                                                                                      Entropy (8bit):7.252548529152065
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEV88yJ3V1aMbgSG1bVahoNN282Vn5ZrMq1lzkaBUgvy5:JwqNn2SqJ37iScbVz282rycFCMjM
                                                                                                                                                                                      MD5:D3243F717AE59CF6FD7FB321481427F1
                                                                                                                                                                                      SHA1:5E78AF0327B7E2DCF4B863C1C149B04ECD0E8537
                                                                                                                                                                                      SHA-256:8AF0DF0967C780179FC269B318EF7DF3CFF75ACC2D8AF05CD55F43E4D902B49A
                                                                                                                                                                                      SHA-512:A737EAC13EE0E43F9F42E522148F5EE5E45A8BFD35DAF18E531A9D521B1A217FF392E7D3EF6A8B5D0713CA6D2433B94BAA802485D4E041000350ED8C0ED2E2A1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DD2CEA94FE5211E1B530976CD51ECF8E" xmpMM:DocumentID="xmp.did:DD2CEA95FE5211E1B530976CD51ECF8E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD2CEA92FE5211E1B530976CD51ECF8E" stRef:documentID="xmp.did:DD2CEA93FE5211E1B530976CD51ECF8E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>rS.....+IDATx.4S.o.D..f..]{7q...I.P(=...*@... .;*.#.O.....Q/9!q.!q..Is U....I..........b......7.1=..I`}...k ....n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010003\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010003\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.950785833444288
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x4xVLH9VnJLKNbUQ5nnGKAX8VXzALysqcs57Jwyn:mVLH9zLKbd5nGK88FA7srt
                                                                                                                                                                                      MD5:197E49C70C1EBF512A341E66AE824536
                                                                                                                                                                                      SHA1:7593D5F3EE7375DA9B0CE7755569AC6DEBEBA7B6
                                                                                                                                                                                      SHA-256:C27090AF8896DCDF6B3C59EBC486629426DD9532C00558B6081540FBA6856C20
                                                                                                                                                                                      SHA-512:E9349BF6572CC3C7FBD13C17EA08FAA922517C1B030150F8065507A8CC1F1B7583DB0E405FBEF80955F92BCA3323D516820D7BB39FD9D2C32FB2A2E1B45C4CAA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010003..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/music.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010003\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.383412945466849
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:NPQjaRVJsbeyPJdA5eB6R4qkb3W0KgoIf34wvpkJs2kn:NoG1sbeyPJSeBVqS3W0KOf34wvpkJsF
                                                                                                                                                                                      MD5:FC5B6A6E3EF44C5D19DC10876796EDB8
                                                                                                                                                                                      SHA1:5139116462D20F03248FFB07202D86DDC10E66D5
                                                                                                                                                                                      SHA-256:5ECFD31E8DF7784BFE3ED70AAE1E7F6D0AAF08A1E322FF20D07D34B5442A511A
                                                                                                                                                                                      SHA-512:65433A7C12B63B349B13460C2751D3A5D31266D1B1087D5DF188BE5E01276FB887C6E189EC1D5A3D82A20BA073D42C3738916DEF288853165256DF15F7240A73
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..................................?{.f..g...g...g...g...g...g...g...g...h...i...i...i...i...i...i...i...h...g...g...g...g...g...g...g...d...r...*.........z!..]...g...g...g...g...g...g...h...i...j...k...l...m...m...m...m...m...l...k...j...h...g...g...g...g...g...g...c...]...+.:a.b...h...g...g...g...g...h...i...k...m...n...o...p...q...q...q...q...q...p...o...n...l...j...h...h...g...g...g...g...d...r...a..g...g...g...g...g...h...i...j...i...k...o...s...u...v...v...v...v...v...u...s...r...p...n...l...j...h...g...g...g...g...d..g...g...g...g...g...h...i...h...b...Y...Z...f...q...x...{...|...|...|...{...z...x...v...s...q...o...m...j...h...g...g...g...g...g...g...g...g...h...j...k...c...Q...V...W...Q...d...y......................}...{...x...u...s...p...m...j...h...g...g...g...g...g...g...h...j...n...m...`...t............l...s.....................~...}...{...z...v...s...p...m...j...h...g...g...g...g...g...i...l...p...l....0...........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010003\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):770
                                                                                                                                                                                      Entropy (8bit):7.667667994524824
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:3aJ6Olfe4ojDeEwAZGoOXXJgwPEPvd6MYnE7:3glfe4ojDAAZ5g3MPlsE7
                                                                                                                                                                                      MD5:8E73320DEA64E756C67D9C2469C3DDE9
                                                                                                                                                                                      SHA1:D03EA57695890D7F4C735790AAACB7BDB41FBE76
                                                                                                                                                                                      SHA-256:BB19792B94FBA34825A7C87B097A6FC1A215F13F6BA03A5C99011DC3BD523C09
                                                                                                                                                                                      SHA-512:C47C93F47898E155EB91070325EB3212A8F05DC298DEA340B9124FABC4DC266BBAF88CB519C9C5E6A274423B05E5DD1205DB1320302937CA5AFC0E5FB5BF5931
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.dS?k.A.}3;{..\L..".Q..........`....".[....@l. .4. i4ELa.1...g0w{......^.p.....y......=....Nf.GR.8.....;.s0.k7/.|(...-.....7Q.........2...DU.Uq..S.RBF.CB.~...d.....3.".T.....`r.G...r.,..[02aL.y.......Ou..#+...w4...E...13Z.....6S<_."...Db...9.U..8.df.pv(.....4...s.htn...8.,b...]... C..p..k..+05R..:.zx....N..i"A.+7h.5Z...'A..t.....$...!.?.pD.SB.:.0..."..{r.PA..t^../.....'9P...`..1..-..r...S.E.AN.3.G..O.0w..m.c.cO...rX$......(..>..9..=U.v+g.RB.M.e...$g..@...........n..P..6..q.o..Q.6.EL.D.cz..9h...lA.V...~p...V...f.$.CQz.....GK...[.~Dm...p.........!.>.#p....T..../..h.V.].$.iV..P.,.;..........cC......$.EO..y R..4;..Z.%Rl..|.G........Dh....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010004\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010004\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.956344065029536
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xFWWVL/3Vn2NbUQ5nx5D+KAX8VXzALysqcs57Jwyn:3WWVL/3kbd5xwK88FA7srt
                                                                                                                                                                                      MD5:877D7A2229337FC4B8F1BD42D959C2E2
                                                                                                                                                                                      SHA1:962552190B139A59859B20BBF889676810203B90
                                                                                                                                                                                      SHA-256:6F5D4CD8817A6B1A1E3FDCDBD3D4AB8F3A6B0137673F0DD839D3B7B3C9D0420D
                                                                                                                                                                                      SHA-512:135DCC9DB8B2F1ABCCC8D6D9BFEFA1607A1D8AF8B64ED404C65F91E29200875A1D3BBADA647BA4C81FE0300BE364CB4DE5EDAC0B7859DFC3FA83291F9171A3B0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010004..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/video.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010004\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.525345605079403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:oPgMlyfRfa3dPrS4msSfiVb1XASV2JVQTpX7y2NMCkD16AhEw+:TftatzS4mWZ1ASVIYpryQMCm+
                                                                                                                                                                                      MD5:EE102FF1CC30D49E1EE94C957716A2F7
                                                                                                                                                                                      SHA1:588455F5CAC8C600F9C109A8A9D36B04F12380A3
                                                                                                                                                                                      SHA-256:D40F7483D0C9F5E99BBBA486788FD26F2CE850B4F4F0105B1C0340FB709FEFBC
                                                                                                                                                                                      SHA-512:D0150E41BDDD0154A0B275337470AD0C61F0E54B915B733F40DE7E0D7EEBD7AC435D0C787B7EB6D4BC1B7658DB6F5B546D4DC59E8BC0DE72328F18F12ACBFD82
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ....................................#...1...0...0...0...0...1...0...0.../.......-.../..20..,0..,0..+0..#/..%0.."/...5...f...o...9...-.......0......................B..(Z.."T..$X..%[..'b..(j..+n..+t../z../.../...5...1...0...3~../|..1x..-r..*l..-i..+b..*`..)`..%[..$Z..&^....................#.*c..(k..(j..,n..+q..,u..*y..*}..(...,.../...)...-.../...0.../...-...+...+...,|..-y...x..,u..-r..*p..$k..(r...C..................%]..&c..,h../k..0l..1o..0r..-s..1x..;..$>}.!>...2.......2...3...1...0z../w../t../r../p..0n..1n../m..'h..$l...H................@.)b..*e..+f..)e..%d..%d..#c..#e..,s..+j...K..(c. 9|..3...%r..'s..*s..)m..*n..(k..(i..&g..'d..(g..+k..(i..'k...N................L.(c..*g..+h.."a...\...\...Z...[..!f..#`...D...H...P..,h..2p..$g...d...c..._...a..._...^..._...a..&g..'j..'l...N................Y.'d..+j..+g.."b..._...^...]...^..#d..#\...A...I...M...H...N..-b..1m...`..._...b...`...a..!c.."f..&k..(i..'m...V................b..i..,i..,i..#e...d...c...`...`..&

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010004\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3610
                                                                                                                                                                                      Entropy (8bit):7.899292397711389
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/x6CuF4wgXk5Ic:bSHIIHUCD4waneSX4
                                                                                                                                                                                      MD5:E78F57089427AA783749018543B1DA19
                                                                                                                                                                                      SHA1:84C16B13CFE2F9B5F7ECA7BF3AD60CBC2C2BC1B6
                                                                                                                                                                                      SHA-256:2287C37DFBDF981D6D24CF8E7B36D4AE3804D57629F28259B4F4987B4AE178BC
                                                                                                                                                                                      SHA-512:DC11BDA55793E119B4A3E44D34B62C8805D929ED4B3155557AEFD97713F1738D1D44012B08FABA842498FAA4B697E79722EA97180BF6429A43D860061F39BB52
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010005\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010005\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                      Entropy (8bit):4.9604710228149305
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x+VLqVnwX6NbUQ5n+MKAX8VXzALysqcs57Jwyn:MVLqnbd5+MK88FA7srt
                                                                                                                                                                                      MD5:2808B6DD4F7D159D33D74AE710CE861D
                                                                                                                                                                                      SHA1:B307A1327BE1420E183E1DEBAC4458F1885FCDA6
                                                                                                                                                                                      SHA-256:88875896DDEEB7CFA205D20E29E9CB0B05EFE3848C9F8621DF3AB2335077A48A
                                                                                                                                                                                      SHA-512:DE5DF30B2547F719403185531638A906C0EFAFB5B578BB3915412A7DCDF39715DE71E56BD3B036CEC6117178D489B1F9D2FF98B2E6643E1839B3177D74A0E6FE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010005..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/game.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010005\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.7310533928540135
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:Ig/FymEUfarNgg9pL91r8HlJjzE0137O0SIVTyr0KmTzo3VSTI0h:htxZOR8vI0d7O0Sw40NPTH
                                                                                                                                                                                      MD5:3026ADAD9B11A1B6351FA78E74DDF068
                                                                                                                                                                                      SHA1:FDCDF989FE0B230FD19A2E677E9AEBC971FE1F2E
                                                                                                                                                                                      SHA-256:1EEBAA6B02555CDC06EA3AA1A7F1E88D19B660F33FB9EFBD2B06941D526541E8
                                                                                                                                                                                      SHA-512:4F93AFC8D1B6826B1A74B3226773A142BB149F7873310F551B4C4D9DD357FACB20295AA763CEE62B8E4D6AB179DC5DBD856FC2A87C79EE31EE963D4D66D30058
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................Kl..Mv..Ai..Ju..)Xs..[~.!i..#j..#i..$k..(k..&i..%g..'i..'j..'h..&j..&k..%l..$k..#j.."j...b..,]{.Sx..Ho..U|..Gh..#%)*........!8E:r...w...}...i...K...d...................................................................h...\...t...........j...2GUM........'=KFz...x...}...q...J...c...................................................................Z...K...y...........}....5GW........(?OR............x...N...d...}...{...{...|...............................................|..._...O...~................2Ce........&=Kb............z...A{..?w..S...W...X...X...W...W...Z...[...]...\...]...]...[...[..._...^...L...F...}...............0FWu........,CSq............x...I...P...]...\...[...Z...Z...Z...Y...Z...[...Z...Y...Z...Y...Z...Y...Y...J...D...{...............9Tf.........5Rd.............u...R...w...................................................................e...N...x...............Ef{.........;Zn.w...........t...F..._...v...{...~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010005\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1013
                                                                                                                                                                                      Entropy (8bit):7.737474544663215
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:7VnREjP+laJQEMkbGCbcZtIQ9D/Q0AMfak6:7VnREjPOLkb3batIQV4VGak6
                                                                                                                                                                                      MD5:6C28A3D7F88C672AA3C3DDF1C71AB537
                                                                                                                                                                                      SHA1:0B556894375739F5C9767D1E10DDD80FF25346DC
                                                                                                                                                                                      SHA-256:B0B0FDD805CDD8C3A3A6167C6D3A328B5A8BCF08E75AA4B623B0D234E9A194E5
                                                                                                                                                                                      SHA-512:597BA016011013A5F0CA26EBB25986DD1F023E946934871F92E109EEAEB8A42A51E11DB5483DE9EAB2B099A381F5A4D784274DFAAD0911B1A01CF346AEC212AC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.$..o.e.....$~&vb.q..p...Vm.B.. TT.Y..JT."....e.....,Z.BH,..]d.J..BE.8Q.fLL....{f.......s..!nqp..../p..-H.Wq}}...{/...g...?8V...G.P.......!|.h.a.}...@$y....).Y...'.......K.~Q1..Z.^.*..._..L_....~.m..8.aF.x.l..t}k.............OQ.;.W6.F..s..Rj9[6.... .&.Y.......;7..vAk^._...:........y....M2%7"....G._V.m..ML...J.n...w.pq9......G..F.p...sh~.9.....I..@....g...g..1.O..<f.{..jbP.Q.T.d.5....[............~..j...."34kj..^..@m$..G..+.Y$#S.*.....&.'.....#..t....K.p........0w....x.U.xgH..L.#/.A..!..I...x&....C|.......N...... 2.@..c/..K...4..'pi...mp.H.l.O*.I......g.BWm.K.`wj..>....tCWE....C0.0..F..Um ......i].\.|...........A.....3.S0...V.t@:.....q....Pa..R.v~...vW..h..D.s.D......}..F.#`s...5.............E.s..-.c...88n.....S......5X..i..l...J..-[.cp.9...C.3.s.c..v..Q.Q$..`.e..i......i46..wAt. .....A....{..%../.U.g.Z.Ig7..|H...v...\!..NP.......U...*.U...T.W.......o.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010006\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010006\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                      Entropy (8bit):4.959938568668223
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xpVL/ehSVnYDNNbUQ5nmMKAX8VXzALysqcs57Jwyn:jVL/iSuzbd5mMK88FA7srt
                                                                                                                                                                                      MD5:00431EF627E9B40E7B50C3586657D098
                                                                                                                                                                                      SHA1:806C0F23726DA7A8DCE625AB8981DB2549D8838A
                                                                                                                                                                                      SHA-256:39AFC8AD2F4ED178F5156862AEE0037FE410D84919AB6D3C588CC18A38820CD9
                                                                                                                                                                                      SHA-512:A83A0AEE5C834A05CE2C34EF8445A6D67CCC92B98A4B6029ECA9475667D8D88773F4E58BE3D8914B104A5A2E81E3E1F3C206689E64D6264086EF7C1761F917F3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010006..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/life.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010006\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.123923091383425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:GUREDVOEUKU+ptPitr73rYbRuaYN65w2d1x16T2/mt05I+s:GUNEUKU0hur774RGN63Xo9
                                                                                                                                                                                      MD5:BC39369552A83C4605FB197B6D4E076F
                                                                                                                                                                                      SHA1:227D9F5AEAFC9A58B3EA8382214122D6603263D7
                                                                                                                                                                                      SHA-256:688E832FE0C40A7CF4E5195EF9CB36914B1FABA99DE324B7865BCA2F43C686F5
                                                                                                                                                                                      SHA-512:F29CDEBDFD15522853A27F5D266008CFAA1BF72C43D522F9B9AB70B54E69B3227B755AE212F2156EAA391651E323E6DA80BD1157DBEB0149AC6081754F30D648
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................|||.............wwwy___=]]]<^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=^^^=___=___=^^^=[[[<kkkA.......................................e.............................................................................................................S...........q...................................................................................................................a...........{...................................................................................................................l...............................................................d...[...t......................................................w.......................................................9.n.B.k.}.......`.~.*.^.m..................................................................................................".c.........................:.h.R.......................................................................................a.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010006\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1690
                                                                                                                                                                                      Entropy (8bit):7.272208627759569
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVFLeT3yJ3VCLuG2dif/lXIrlss8t8Ig3XGi8/t/UYAieL9:QWHNn2qfaiJ3KuAJIt2WXGDV/4VLDwI7
                                                                                                                                                                                      MD5:9DB9DB4903D7E1AD0B26FD00F63982D6
                                                                                                                                                                                      SHA1:F5B1C5095D946DFD0C98EB143CD17F01E17B4377
                                                                                                                                                                                      SHA-256:686A61AF03640B0BAEB5946D06F3A0E5D0E146F767429B76EE5733D0F9D1A116
                                                                                                                                                                                      SHA-512:CDF363DCCAD5D997253DB4F1B53FD07B0B19332DFFD5EC4FD868768EED497A3C4A5AFDAC7E00982E011184074F5760BBF22391BA95AB5EA3CBE56799F4552F6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:FAB7FA9FFE5311E18FAB9597E2C2E77B" xmpMM:DocumentID="xmp.did:FAB7FAA0FE5311E18FAB9597E2C2E77B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAB7FA9DFE5311E18FAB9597E2C2E77B" stRef:documentID="xmp.did:FAB7FA9EFE5311E18FAB9597E2C2E77B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8]8....IDATx.$S.o.E.........(.s..v.( AG..4!.H..h..P!Q ...R.?AtiR.....$......r..K..........f..f..........-.|G.....?xy....r.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010008\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010008\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                      Entropy (8bit):4.96354868738225
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xTVLuXVnIkNNbUQ5npWp0oMKAX8VXzALysqcs57Jwyn:5VLuXSQbd5pNZK88FA7srt
                                                                                                                                                                                      MD5:C044B9480270FB60A72E994D7CFBBC0B
                                                                                                                                                                                      SHA1:76001BC99F03C05C9C10326DA9D04F4E5E4D1E5E
                                                                                                                                                                                      SHA-256:69FCA65D70DE780130CD6416B4332138E465035EE966FD52D8955646C6A7767A
                                                                                                                                                                                      SHA-512:076ED3587BAB4FF6FEBC7F9D54D74A1A37B885162E939B26388810421EB811C75B7F78F51BDCEFABC214B517952FFA13EBBF08B9391571F7871DB4A4FC1A5BF1
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010008..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/fashion.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010008\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.664757497114004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:Ms5EgVHimUP2rbGknnpF6UuVoE1mRVY7uV8fSNWYfhl8/FJ0+6AN:t7Hn/rbGMpkUuV6zYuuSNWYir0+D
                                                                                                                                                                                      MD5:F023EC5F28C4652DE4EB7997B7B2125F
                                                                                                                                                                                      SHA1:D20156CC75F64EC63A9C4086308714E6FFB5FF31
                                                                                                                                                                                      SHA-256:1E395B7D62ABF73CBDD83FF9DA0FA125C29C330998F04B8F8E31911F88F1B43B
                                                                                                                                                                                      SHA-512:6514396B8DFE68C5340C13389F11A5C0DA7A1B5EB8A97AA9CD8C8BE1403FFCD9262F2AAAB22E8B548F3116C33233DFBD7105BB7FC8E92622CD4925C86C8EF8C2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................``a8...s...p...oxr}oy_.k~a.i~b.j|d.j.e.i.f.i.g.i~h.i.g.i.g.i.g.h~g.i.f.i.e.i{d.i|c.i~a.iy_.jxp.p...r...p...s`_a<................/0/......~..lV{.O.~._...i...e...`...n...t...l...i...x...y...l...k...s...p...b...c...h..._...O...kP|..x......FEH.................X^T.....s$..y ..x(...+.......2...6...9...;...=...>...?...>...?...=...:...7...5...0...-...+..x&..y!..y*..........???.............dp]..P..z....1...5...3...4...7...9...<...=...@...A...@...?...>...=...;...;...8...6...2...0.../...0..."...T......MLL.............F:P.v&..w...y...t...............}...........................................................w...x...y...y&..ZJd................,.Z.l...w...t...n...............u...............|...........................{...~...........q...r...v...m...*.Y................:.m.t...~...v...r...............|...............~...........................................v...v...{...s...7.k..#..........,B.x.z.......{...z.................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010008\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827
                                                                                                                                                                                      Entropy (8bit):7.3468622709312745
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:JwqNn2SJXatJ3E65j2WfLnVbZ9Hd4zGlvpkr:12h2gbDHdO
                                                                                                                                                                                      MD5:FB6F20EC94D8F6620BC4813CFD21E07C
                                                                                                                                                                                      SHA1:C9330A96AC7CBD4C30A7C67EBD96763339FBB23B
                                                                                                                                                                                      SHA-256:504FA6DBF57662A4F6AD692981E0772EDAF516D577DC9C73F0FF4BA856ACD8A1
                                                                                                                                                                                      SHA-512:3E1655C6B1DBECBF46F6842FAA0006F3E719651DDEDEFFA0C707412A5FD7BE07B1E97B915A1B16B0F5FD7625FD6CC91268470EACFDDCB5FC8B800B1264439105
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:EFA7C054FE5211E195E3932ABDA7E579" xmpMM:DocumentID="xmp.did:EFA7C055FE5211E195E3932ABDA7E579"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFA7C052FE5211E195E3932ABDA7E579" stRef:documentID="xmp.did:EFA7C053FE5211E195E3932ABDA7E579"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Q]O\U.].s..;.03.P....".$...hS..T.....}3......&&&.'}3Qb....T..M..%B....3..0_...8.x.a...v...4..?Z..3

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010009\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010009\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.962132144658908
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xixVL7rVnmNbUQ5nlMKAX8VXzALysqcs57Jwyn:cxVL/0bd5lMK88FA7srt
                                                                                                                                                                                      MD5:46ED24D9C05D2FF8C25F2514E71AC4DE
                                                                                                                                                                                      SHA1:12862A40DAEBD9D306D88E903E355A298EDA55CF
                                                                                                                                                                                      SHA-256:4D8522BC9D0F4667943DD00526F6317E533F8E9D11F9459AF03B646C26D127A8
                                                                                                                                                                                      SHA-512:C0C42E208EB9A781565A66D4B25432BAE452D0F2F7C26491809D2AE9823659F6520D03040535EDEF50B298D08C53371AB736B8FC220BE81F278BE4F37CD45D2E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010009..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/tools.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010009\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):4.950724673411782
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:6LRdUSYknCN8AC88mHmjOZahs1JDlg3rl15tz8wnSQ3h0YoDoWSsiu0mtb7AqwCH:1TknCYjbjggoar7z8wSY0TrScspL6
                                                                                                                                                                                      MD5:5ECDCCB9FC99BD54FAFA7B66AAFA8E98
                                                                                                                                                                                      SHA1:4864F297BECCFA356E0C4BD52E7957A5DAC30E61
                                                                                                                                                                                      SHA-256:EEA96B28EC5B0004E0728D9C633C428287C64D80D6D65984B2DA5A38EB064B91
                                                                                                                                                                                      SHA-512:059634684795CB0B16E37188AFE3858A6DDFEF4B89F83BEB120FDF9B8C5E145C81C5A8F54B26B75D87162E5D2BCE9ECC0134D2E9B7842C2471EFADA2B6BB8512
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .............................8;?.%..k#..v"..s"..s...s...s%..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s!..s%..s...s...s!..s!..s!..t"..x3Ta2............1Si@............................................................................................................&...............*WnG............................................................................................................................#_{K............................................................................................................ ................j.W.............................................................................................................................s.a................................3..............................................................................................g....................................................).........................................................................s..................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010009\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1573
                                                                                                                                                                                      Entropy (8bit):7.156172199592931
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:S1hI+Wwjx82lY2T3BkVz/BoyJ3V8peGY2x8Ewb7RQH9wTdMxCKiInW8oOPh9+P:QWHNn2qHrJ3yeJE8f72i6v3f5JUP
                                                                                                                                                                                      MD5:839BED271E6C514A5D2EB7B71E6D4B11
                                                                                                                                                                                      SHA1:97B4D4D8178C0E92A47DF236EE8B9067E6E0474E
                                                                                                                                                                                      SHA-256:3D927AA49B006349F65C5D17CECFDB7B0066367F768ADE0A70A3C0D34EDC0E90
                                                                                                                                                                                      SHA-512:4496DE05F886E7D0EBC066C5F69AF30D84D180517C9A4ECB4C445389106B7B8E6E53985EBC4296D99DE2A1A5828EDFF30C5610494FCB98E0D7AC21417C67FC21
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:00C3D49FFE5411E18077E37066175716" xmpMM:DocumentID="xmp.did:00C3D4A0FE5411E18077E37066175716"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00C3D49DFE5411E18077E37066175716" stRef:documentID="xmp.did:00C3D49EFE5411E18077E37066175716"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..az....IDATx.L..j.Q...s..W..t.T..[..J-Y...P....@....gP..+..+..,.m.....6.6.$.u.w...~.;.s..Qj..,....T7P.g..?.Y.XaP.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010011\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010011\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                      Entropy (8bit):4.949950243042386
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xkmVLeVnBqKNbUQ5nfI5MKAX8VXzALysqcs57Jwyn:ymVLe3qKbd5jK88FA7srt
                                                                                                                                                                                      MD5:26312D153000D2C2F383C0F630E64E15
                                                                                                                                                                                      SHA1:9FD24B4EACD050A4242F8C18A2F94FC1BE9E2B04
                                                                                                                                                                                      SHA-256:2EAC776D15900830F6E53E15E6FE876DDDCE8E6AB0B247AA47DB1E7180905CD1
                                                                                                                                                                                      SHA-512:9F24BA99E85909F9C6A106D9A12365C525FF6537DFF525B081859DC901495FCA204B5961EA201D685FC31C31BAB848443AEFC958CDAB3038B2E34E4B541B9B58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010011..version=1.0.0.1001..name=.........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.......url=http://static.apc.360.cn/cms/mini/novel.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010011\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1150
                                                                                                                                                                                      Entropy (8bit):6.696759280646044
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:WWxaAbGln2PbNPx4vHfGd89oDpMZvf6Rbqr:WWx/c4wvHfs86DpMZvfqA
                                                                                                                                                                                      MD5:1C4DCAC9F552D56878D4A52FCAC1A7DF
                                                                                                                                                                                      SHA1:F188EF7E761D206FD1274AAE2F05431C012B3B81
                                                                                                                                                                                      SHA-256:4272C8895326A053B5DB012715BE6E925DEAC6C5686B385E231DB02A3E95D41B
                                                                                                                                                                                      SHA-512:949584652F9EF91ACACCE97D616F8D183F0D2AEC7ABDEB659F3E24DFFBA06D3F2EF83F503D87379FAF7EE32F5C48256F2B8564CA6CF4163D22014B97091FC1EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:............ .h.......(....... ..... .....@...................1[hZd{p.bT0.XY?.<h...>...9..6\}.*My..4z.)R..8h...3y..=..E.../W[/<q|.vQ..yM..{H..**R...........p...p.......s..${..........@..1ipJ7^a.wP..uT..|J..-%N......"....u...t..@...&~...|..#...$...3..0juS9UQ.s\(.ee8..K..,$R..B...>....z...x..?...(.......(...P...;.."HQaC[T.r_..clC..K..)%^..I...B..."....{..e...@.......)...d...<..%N[oM_S.vf8.`{\..L..&&g..R...L...(.......W...=.......-...q...=...ct{UdU.zb/.hqH..O..$(r..N...H...0..."...Z...@.......0...Y...9..+bz.]jZ.`..}o/..P..!+}..A...?...6...&...<...1...!...2...K...9..#Tn.ry\.w.......a...4...W...S...D...%...?...3.......8...S...D..%Y|.s{R./...;..e...8..2h..0c...I...5..:R..$;.......H..9l...K...V..l............}n.PH|.........F\..............................0c..s...............l|..........`r..............[x..............Gfjt(<AK........................Uv......................................s......................Jx..x.......................Q|..........(8=%Ioxrn..............)K..>l.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010011\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):992
                                                                                                                                                                                      Entropy (8bit):7.7713387585355544
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:A0BZmIxT556WHubIfgZwEt0Frl/S29T3WjvNepc:feilcfIfI/ErlS2VOei
                                                                                                                                                                                      MD5:844DDCA1D925E71E9B64DD39EF95735C
                                                                                                                                                                                      SHA1:12B52B95064E670B5C0DD0C1AAD4E1850537791D
                                                                                                                                                                                      SHA-256:4FE063A8E4F55F31B647CF4EAA29B3C1C77642A912582DAE0C7687133EF5CF2E
                                                                                                                                                                                      SHA-512:2573314F71A0F1DB258C34C9517C12710A32D60D83EEC7DAA15536D6EDC3B7136FAA7256D9DEF79BD1724C8A8D400695850BD04CCEF1AF55922BB9F5897DCACA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..SKh.U.=....y%3..$d.4..ABq..%R..@.)Yt%j.RQ.n...]Ku.. ..U.......J...j.G......u..v...{............"?.Cz 6v...c.....6.F.rc......~[..]..Z.z.\j..$.H.......+K.g_-=3.88:5l...w.|..xqh..w.D....{.[[{.w.V....kW....;..........."..P.D...#.(...g)K.".:.+....&....pb}..>.|..rb.....Q...).........*....3.Y...........#C..}...o3.G......K..A{^.~Q)..Rf.AsH....?..{..*U.....3'.w..;...pe]....yNM...V.#...."........}G..el....<8io.c._..OT.Q.._.o`..1."Q....:......*&.c.x..y....)..I...O.Q.L84....6".4y.n.C2..B.ohQ$.-.._....3][.5?.."...f+K..*U]e.......8........Eh.{....R.B?G].h...'-..P....Ip.Hj"..!.q...n.&..Q.:.R.C/a......%.&.65..$.F.T...._J.8$.-0b.......e.2......@..W.X..n.X.....|.......r-...=F...5...E......6P(...y..Y.C.^]>.....r+.c\.5... ......~...Hb$..J..q..-S.L.3.....9.M4:.mz.a;..>H.i...0......t....`..g i>0V...G..W.Q2..tdP..'!....(...Q.I.'....T6..I....QU.S}........... .....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010012\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010012\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                      Entropy (8bit):5.025645351265841
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xiovVVLHS9VnawDmNNbUQ5nuMKAX8VXzALysqcs57Jwyn:5VVLy9PDmPbd5uMK88FA7srt
                                                                                                                                                                                      MD5:D4E12D133CE4E63D87FDE596EDAC6D7E
                                                                                                                                                                                      SHA1:B433F4E9765670DAFCDCB9A6CB2FD7698AAE393B
                                                                                                                                                                                      SHA-256:9406E9933AC0D54302654482A0DA93ED7981E11C93E6D890CB591CB5542F4FF8
                                                                                                                                                                                      SHA-512:216AF6837F4DB96E5E0CAD0F0C5965AEC7156EA0CC4BFB7046D156BF8C8C19BE18290C6EDC6CEBF4C7B1D9C2216A2DA51DE6A5B4B1091D7944CB70217F636DFC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=102395752..version=1.0.0.1002..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/picture.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010012\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):5.306748975761254
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:j/ezRWrNDg/nHfXMw/IQUr7jR3yIflOnxjSROQjhZ:j2VW5DSfXMyUH1llO8RBjhZ
                                                                                                                                                                                      MD5:39F1AF5D20B5FA3BD8A9446A08E3F6A8
                                                                                                                                                                                      SHA1:5070BA1EE5D7D3596977B8E6B7C38CF12B492C16
                                                                                                                                                                                      SHA-256:50D0F6832BA9490B64C43EAF5EFDCC5F8D5641616047DD6065ECE79B0EBDC3F1
                                                                                                                                                                                      SHA-512:8BFC8F7526C01ED99668996BBF1439B6AF0DC72FF6A4702BF234B4DBC1F72B0DACBE71510F2BF84092DA820D228303D6A3CD582FFD73D61DADCA86C08E534A5B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...I...S...T...T...T...T...T...T...S...S...S...S...S...S...T...T...T...T...S...U...U...U...V...W...W...W...U...S...T...T...T...T...T...T...M...4..........................................."...^..................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010012\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1707
                                                                                                                                                                                      Entropy (8bit):7.290497360373356
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:QWHNn2qUfJ3r/3B+p8WjcGE1g/gmj2ggbLC0Y7:lt23h/3B+pdTE1gPj2ggbO57
                                                                                                                                                                                      MD5:16F57A2638753B17F72DEFABE38E53CF
                                                                                                                                                                                      SHA1:78D7687CAE55FBC059FA2AD6BBFD97B3567B3122
                                                                                                                                                                                      SHA-256:A5A4143320D633EDB78AEFA71F585888D58EBB1DDF6F6CFD20A61749B1523486
                                                                                                                                                                                      SHA-512:3C3973196D100CC8CE279C40F6A8C8FD7954FA89EB77AC655C2E174279534A2A4E02E13AD5DA2E64415B40459170A0EAFE2F13BA6C07B755766BE297C0150E45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:7BB909554FE811E292EF98C5F7C4FE29" xmpMM:DocumentID="xmp.did:7BB909564FE811E292EF98C5F7C4FE29"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BB909534FE811E292EF98C5F7C4FE29" stRef:documentID="xmp.did:7BB909544FE811E292EF98C5F7C4FE29"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..vV...)IDATx..MLTW........g`.....7"...B.h...&M.....6.&..n.B.&.%a.6iH.IjR.M.5.q.`.# 0.....y.....E.'...'.s.....,..........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010013\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010013\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):321
                                                                                                                                                                                      Entropy (8bit):4.9662771090398525
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xVxVL0SXBVnXXKNbUQ5nVKKAX8VXzALysqcs57Jwyn:VVLJB1Kbd5EK88FA7srt
                                                                                                                                                                                      MD5:4720DA30ACD35F7061A009BF12097431
                                                                                                                                                                                      SHA1:4458795E744C92A6D3891AEBF0A0716896E8957E
                                                                                                                                                                                      SHA-256:423B5D3027D9F7F47168244DA4DEE695B2FC330C11E11BD622660FF199BE6D65
                                                                                                                                                                                      SHA-512:DCF023B0D3A2F4B550F0204BBADC7D74350F81035593C77361880635BAD00A4BC3AC03BF05688C7D0EDB240983C65892B964FB7582A004605417D3DD1E5449C9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010013..version=1.0.0.1001..name=..........[AppSetting]..icon=logo.png..smicon=logo.ico..title=........url=http://static.apc.360.cn/cms/mini/investment.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010013\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):5.800853721893965
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:haFaj+hpA4r/fcuLM2iji5PS6QHKcE9JvIHxJgFqsZXQFETuPDUvdsjd5w+XkG7J:h+Q+h+C/M2hQHKvfgsZXAIvCjMOkG7q0
                                                                                                                                                                                      MD5:1D03B03E28B1F81EA1B58CE87A667E07
                                                                                                                                                                                      SHA1:D98DE8B7B172475982EDB9EAC227AAB77A08A17A
                                                                                                                                                                                      SHA-256:197E99F7DB21D5776B92F4D1420174B98D82B1F5EAB25D3D9946B802D4885727
                                                                                                                                                                                      SHA-512:914A503E060FB6FB2A6A99705477B2955B460C0B4AF80182C9E1EBD21A337C89A2A242AFE9769BDD29448DCD8430FE5809EFD412DB4245CBA53E8C4162C0B6B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................B..,._..^..Y..Z..Z..\..]..^..`..b..c..d..e..f..f..e..d..c..a.._..^..\..[..Z..Z..`..X..P/.!............O".J.q...f..._...a...a...b...c...e...g...i...j...l...m...n...m...m...l...j...h...f...d...c...a...a...`...g...i..X4.6............U%.U.o...b...]...^...]..._...`...a...c...d...f...h...h...i...i...h...g...e...d...b...a..._...^...^...^...d...f..Z5.8............V&.U.o...b...\...b...e...\..._...`...b...d...f...g...h...i...i...h...g...e...d...b...`..._...^...^...^...c...g..^7.<............\).c.p...b...P...L...d...h...^...`...c...e...l...l...i...j...j...i...h...g...d...c...a..._...^...^...^...b...j..g<.N............`+.h.p...a...S...E...J...b...k...a...e..._...\...o...r...j...k...k...j...n...j...c...c...a...`...^...^...a...j..i=.Q............b,.l.p...`...`...W...I...L...b...p...a...X...X...]...r...w...m...n...h...a...q...m...d...c...b...`..._...`...l..rB.Z............m2...p..._...^...b...\...N...Q...`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010013\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1676
                                                                                                                                                                                      Entropy (8bit):7.212829335167512
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVKwfyJ3VF5G54o6B+DJtHQdHecKMdPP1oOGtVvvhPaq:JwqNn2SvKJ3d0bL2+viPyO6Pa05d
                                                                                                                                                                                      MD5:9CD270D5DD770AAC24E31A354622B6F3
                                                                                                                                                                                      SHA1:556EB8862702CE14A365BDAEBEB37B7B8BB8BB2B
                                                                                                                                                                                      SHA-256:E3A5419CAF661070EC8FAA0B2104CDE36A278B788829DA077CBA1E68F3794A34
                                                                                                                                                                                      SHA-512:8511232D87EEAA380F22B6683F2F1A4C78F2D7F0D5D91F6633A7BAB793B07EA80F6A40E46E43F17B9281C35D791C6AC8B48120F914C88CB5B509625C501C088E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:020B3D84FE5311E1AED0CEE83748DAC3" xmpMM:DocumentID="xmp.did:020B3D85FE5311E1AED0CEE83748DAC3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:020B3D82FE5311E1AED0CEE83748DAC3" stRef:documentID="xmp.did:020B3D83FE5311E1AED0CEE83748DAC3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,..F....IDATx.$R;l.W.=.3;.k{m....e..AB2."D.(...!. Q.@.D.M..iRP.KK.&..R.....!..l......^........4zs.=....?..@.....j.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010018\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010018\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):319
                                                                                                                                                                                      Entropy (8bit):4.967324401143455
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:x9WVLdVnSuYNNbUQ5n2m9mMKAX8VXzALysqcs57Jwyn:yVLdcuYPbd52m9mMK88FA7srt
                                                                                                                                                                                      MD5:2A0E5B9F974C4CF0F01B6B916FD959B6
                                                                                                                                                                                      SHA1:60CA4EB38BCFBA4DA1AAB07BF964642B0878FA0C
                                                                                                                                                                                      SHA-256:08594A9454BE5376EAF97020DFFC1497A147CC0CDAB6D7C4A1ECF04F0E86B4BD
                                                                                                                                                                                      SHA-512:E054BB158849E7C6596E8AE0B7CF641C21CF2D5211388E6DF1ED2935282889C7F5162B15EFA50E6B2FDFD98BB3ECA15BD62999DC78C665282AB36B1B54B2BE0A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41010018..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/shopping.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010018\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.244375588470727
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:80oBnFFn1dAxOLarnebhRA+vMUvu5PZvuagihZNZv9XXgoFs2tiOCfnzP6oe9nd:8TdT1exOurneVtEUyyyNngoFH8nT6zd
                                                                                                                                                                                      MD5:39C449DFD4172C8FEF4D79D8F3ECF019
                                                                                                                                                                                      SHA1:B76585CD211E0BD19328FFB6A6BA306BC6245C4F
                                                                                                                                                                                      SHA-256:C0FF5EEA0BFF68D6A67AA730C16E704AF401CF5A60E5DEB7BD56E791F0A7F78C
                                                                                                                                                                                      SHA-512:B2C8BAA61223A3A995CC9827B1F8134A77594109495040081D399FE49391D56297A7E23DE71216537C747E068407A59147C6E41E35A8D5B1442E0AA7D0A44D00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ......................................&...6...>...C...G...I...M...P...S...W ..X"..\#..\#..`%..]$..]#..Y"..Z!..T...S...M...L...H...F...A...;...4.....l.................aN.-.p.2.x.5.}.8...8...;...;...>...>...@...A...F...@...D...D...A...?...>...=...;...:...7...8...5.|.1.u.,.m..9..................S...o...{...........................................|..z..........................................v...o...6aa.................U...u.......................................}..........................................................n...:ol................(B...e...................................e.......q..5.u.<.~.y..v..n...............................}...[../sn.............. .:Q...r...............................i.......g..%.c.+.n.&.i.!.`.l..w..s...............................h...>................$#FY...|...........................x..........8.r.k..=.|.#.b.\..C...~..p...............................s...C.................-Qd.............................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41010018\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1754
                                                                                                                                                                                      Entropy (8bit):7.285789734958503
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:JwqNn2S2J3rJvlpu22AjzCy5bOONHYkW5tLbZ:12Z62lzCiNHYkWTbZ
                                                                                                                                                                                      MD5:D4C8F1DF118F8FC64AA4DDDC31F29697
                                                                                                                                                                                      SHA1:7AE57827226012EE65A4893A8070A9775F28A084
                                                                                                                                                                                      SHA-256:6B6F88BADF77410D370E663BC2B3980C1C48FBD52BAF156D86673EFB7F88D213
                                                                                                                                                                                      SHA-512:6B20F93F7213C37EFB1F684FAE64F115A32DED84108E42A54FD5A55ABB80DA87DB68C5CFE60460388F18DB3B359964B06635C6F0E1BB2500CB38431A0077A1DC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:CA5BDE84FE5211E181C6F1422FB0459B" xmpMM:DocumentID="xmp.did:CA5BDE85FE5211E181C6F1422FB0459B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CA5BDE82FE5211E181C6F1422FB0459B" stRef:documentID="xmp.did:CA5BDE83FE5211E181C6F1422FB0459B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9......NIDATx.d.;l.U...y...........$2....XD...........$$...@"4H....&.H)(....$H....;q0.........w.:.tns...9..+e..{......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020002\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020002\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                      Entropy (8bit):4.9686066710509476
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xViVVLZVnkJNNbUQ5nVlL9MKAX8VXzALysqcs57Jwyn:oVLZ6Pbd5Vl5MK88FA7srt
                                                                                                                                                                                      MD5:183747990356B87208C54FE122A7AD2C
                                                                                                                                                                                      SHA1:4296A5E0BB5B62A4E973E67CEB590484654332FB
                                                                                                                                                                                      SHA-256:94AED96FF80D2052397990FADAC17F56F2E2F810F39A9A20157D2AF7F44A7278
                                                                                                                                                                                      SHA-512:F70453499C91806D3DDEB64CDC24DBDD222C8E7BDDE7BA24BF6E893A4494CFA184A4A3DC1DBE8D0583A2A79C4A8444B8113F6A0271150853F142468EEB2C7849
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020002..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/news.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020002\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.502356981324228
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:KeCgIIwzEW5T4AN+8afhZ1tT6wVPIaCs0LH2AmW:KerIIwzBT4ANnar18wVPxqLWAD
                                                                                                                                                                                      MD5:D476ABA8D99BBF39C7CA914BBF30DD35
                                                                                                                                                                                      SHA1:5DF2375B3EBA919244D26A00E78DCA264A4C076D
                                                                                                                                                                                      SHA-256:93EF9FB51A4142EC5407799A0048ADE165E3EA335B2179BBE7E2B0917EB56858
                                                                                                                                                                                      SHA-512:664D6771A0B74BBE57C490ECB790B9C0CF1881367B13BF5E74DCE939D39E30C804A2755FA9C52D83F562958764C5B2C946A14AA13F2A4C3466EEADC7029F1DD3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .....................................................................................................................................................................Cs..7h..<k..An..Ao..Du..Fw..I{..P...W...Z...]...\...\...Y...X...S...M}..K{..Gw..Du..@r..<r..;n..<m..7l..?s.Y....................-Z..5\..9e..?h..Ck..Mu..T}..`...l...t...~...................}...q...k...`...T...Mw..Bn..?m..;i..7e...]../g......................2]..Ck..Iq..Mw..P}..W..._...j...r...x...........................v...q...g...^...X...P}..P}..Jw..Ep..<h..2j......................6a..Jq..Qz..W...Y...^...c...l...u...y.......................}...u...t...n...b..._...Y...Y...S...Ny..Bo..4j......................:d..Rv..X..._...a...d...f...n...He..+DY.[}......^...'CV.Gg..~...e....FX.5Ri.b...f...a...a...Z...T~..Hs..6j......................=e..V{..]...d...g...j...l...f...%@S..0A.9Yr.....Ee...7H.Hi..}...Z}...9J.0Of.g...j...h...e..._...W...Mw..7k..?r..................=e..W~.._...g...k...m...k...p.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020002\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1747
                                                                                                                                                                                      Entropy (8bit):7.285774204678194
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jy1htZdWwjx82lY2T3pHEVQlKFyJ3VagAqGdqIWoT3gmDRaLhXN5JXK3bmZ00dUO:JwqNn2SuJ3VPIWq3aLFN5U3bmHKdC//
                                                                                                                                                                                      MD5:571AF2707D1147E42B208A5B98F98BDE
                                                                                                                                                                                      SHA1:38E75672641FC4C836EDBF11473C362B8729363B
                                                                                                                                                                                      SHA-256:2F22D05B68B3A16479AE3D04686E2E422A8E734D1A26B2FCDC2A795979E8C832
                                                                                                                                                                                      SHA-512:F073602044EEDC1FDD1F05EB0E5B71284A392FC88C2692AA5C40A2E67CDFFD2647DE00A998A0E5D131C30744EA9820604280EE492E6699C6652AE0B4E7B23DF8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:1877BFD4FE5311E1B6A8F56F97B9BCDF" xmpMM:DocumentID="xmp.did:1877BFD5FE5311E1B6A8F56F97B9BCDF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1877BFD2FE5311E1B6A8F56F97B9BCDF" stRef:documentID="xmp.did:1877BFD3FE5311E1B6A8F56F97B9BCDF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..?....GIDATx.4RMh\U.=.}..7?.L'.dL...*...R*. .....E....u....].(.u.R.*"BH.A.U.$N.4...y....K...{..s...03d./8y......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020006\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020006\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):326
                                                                                                                                                                                      Entropy (8bit):5.047002109476319
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xV4VL9zKVnCKNbUQ5n/ky9MKAX8VXzALysqcs57Jwyn:8VLwUKbd5/tMK88FA7srt
                                                                                                                                                                                      MD5:B3010D5013CE394490FDD675EACFFEE1
                                                                                                                                                                                      SHA1:980A80543CF558C5B9C95E8B193DD1D27A2553CA
                                                                                                                                                                                      SHA-256:EF20DB1DE1250B46ACB32D5C1CE97F085FD67AFA421CF6F2DE6CD1F3A2042542
                                                                                                                                                                                      SHA-512:ADF00AE70CE375C535EDF3ACC7CEB48353B856A2F1D326E1D79A36EC9C72DCB486BA9DCAF4BA9DDAFC9637CEF4A22FE12D170C3EA0B636425AF6D506AF286B32
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020006..version=1.0.0.1001..name=..............[AppSetting]..icon=logo.png..smicon=logo.ico..title=............url=http://static.apc.360.cn/cms/mini/magzine.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020006\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.306713577547797
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:UM0mIfogLvt1rp5q0afKkwCrzT6vwXiZESw:UM0x/D7rDqFSNCrzT68
                                                                                                                                                                                      MD5:3F913DE1863481A1EB2D4400DF2981F1
                                                                                                                                                                                      SHA1:DDE8678AC1DDFEF0A6EE438CF4BF32E7B6274C63
                                                                                                                                                                                      SHA-256:5F5A309335670B3B63147D061C5C4523A656A43B44E9FD6BC5B77B057D76DA08
                                                                                                                                                                                      SHA-512:0F71EBAA314E6D7B62F90B463F466832678388E59E5AECFC46259400E0696E2DD24404CB51A57211EF6D838CACC04FDF820ED1CDBD23768525B8B44BE3E342CD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... .................................FFF/rrr.ppp.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.ooo.oon.oon.ooo.ooo.ooo.ooo.ooo.ooo.ooo.sss.bbbh................uvvv............................................................................................................XXX.....................................................................................b....................................lll ........................................................................................+.................................iii&.....................................................................................I.......$............................KKK0........iii.........................................................................u.../...e.....]...-...J..K..U.........SRR6........}~~.........................................................................F...............Q....9.....5.........bccC..............................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020006\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):939
                                                                                                                                                                                      Entropy (8bit):7.715337267518902
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:TgnmyMGQ6rbGPaBviHyDAdqrlGJvk60U5:T8AIbGPaligdUvz02
                                                                                                                                                                                      MD5:2D40368B62CCAB60F49FA64586721507
                                                                                                                                                                                      SHA1:209354B6EB8543E4E5006CC565518888E26A5F25
                                                                                                                                                                                      SHA-256:106EE2D49EDCC53D777C46ED92E94D552424D5EDC1240A4D13CEBF7240BA004D
                                                                                                                                                                                      SHA-512:F6331635FCF499B090DBF6F3D42C3476A35B6A8E0DF8ED55358C29DA4B938315E4CE2CAB3E2884D12B7B65FD9DC5EC05D4B35D887ACCCBC86ECC90305E7B3D1C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..S[k.e.~f......nvvc..mk+V.....Ik..(...(.^.......j..!x#.w....x(..sE...l.4.f7.=.y>..>...y..y..8...|.....5gu....f. BV....Q..S$..%....5.:0..7.o..es.....>o...j.OpMB.bb4.@.5........;..C.=.+...W.XE?#.P..UK......n\..@e..N`...a.....j?.$"<.0&3.R....g..{B*....H:...gI...B.%.2..#8..L...w[.8..Vmb!....'...GO^..`....PX<.k.=F.!.Z..9D9E..8...-s../.P.&>x......{E-:._4.d....a...LL9......=uf.......t.r0x.&[.-...*..D..$.dYF..0..&..4{$jA.H.4c......;.uG.....'.9...p]..j..O..Q..a...".)R...eY......F.s_.u9.`.6.8.O.3.c..a.7....p...R..#.X}"-.....B.@Z%...".p..\(........e...J.r....N#._..sP...)....K.sH8......`."..eL..........:g#f$.i""........Y..}....(.......~:..G..,O.8...y....N'.....h.X.I..aU...........#.,....P.Y...!.T.`.$...?o....^.......&T./P.I..v%.(.4.....R.-O.....,....ah..bW..n?.lnn.'=....QQ.KC.j..o.....W..r..P.{..A..v..`...6{_.{....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020010\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020010\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                      Entropy (8bit):4.990346257397384
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xJuWVLNxVnJwNbUQ5ne0oMKAX8VXzALysqcs57Jwyn:+WVLNxUbd5ZZK88FA7srt
                                                                                                                                                                                      MD5:DADD037E0FCAF23F1FB8AF021329E6F8
                                                                                                                                                                                      SHA1:FA4B3498B7FF91AA83036858902470B79ED44B3F
                                                                                                                                                                                      SHA-256:BA919B0A6784A419D67BE03D57138900416A8F3896F744A8308026F846D8C634
                                                                                                                                                                                      SHA-512:518B340222FFFF911053313C02A096D162EDA835B76945FA06837DF5C1EE86D783BF8DC83BDF32A521CFFC5AEFEF230A9EA67B33EC98412345F115748BDE5FEF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020010 ..version=1.0.0.1001..name=............[AppSetting]..icon=logo.png..smicon=logo.ico..title=..........url=http://static.apc.360.cn/cms/mini/education.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020010\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4286
                                                                                                                                                                                      Entropy (8bit):6.08454985861445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:Y96oqv8mYYZ2cbO752hMe5Drzv2nEKZZtP4hbBO+CG50Js0UOX2bEFalXy0rE2GE:AUeYZkwpXzvaJfPOYycs0EVlCBrECc4W
                                                                                                                                                                                      MD5:1C48CB227F217912E6CCDB2B1D95B9DB
                                                                                                                                                                                      SHA1:ABD047A0933CFD377F2F16AD2AF9577D53E8CEDA
                                                                                                                                                                                      SHA-256:48048E284E74ED98B89470BDA05F48CF6618745348D64BE08D7789CF5FC4BEEC
                                                                                                                                                                                      SHA-512:20209DE59D8233EB200D6D5F479389439185CC70542880BA57BFF289564CF00CB1C9243FCC9AF2F833B0AA2F60F7FD27C967DC72A39AA3E6697E80A1929E1C47
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .........(... ...@..... ..............................1a*1...7...7...6...6...8...4...6...8...7...6...9...6...7...7...7...6...7...7...7...7...7...7...7...7...7...6...:....CzZ.........@vIH...J...L...G...G...J...E...G...I...G...E...I...E...G...G...E...F...G...E...E...G...G...G...G...G...D...H...Q....Z...........L.QF...B...9...P...S...R...O...N...N...M...M...M...L...L...L...K...K...K...J...J...J...J...J...K...J...P...@...K....a...........S.`K...9....Yn..p...p!..n...n(..q"..r...t...p'..s...s...q...m...j...k...m...p...p...n"..n"..m'..n...n../.X.T...H...!f...........b.iL...9....PY..\...\...\...Z...^..._..._..._...^...d..%n..(p...j..#l...a...V...Q...R...W...[...Y...Y...W..K...K...%m...........[.wN...9....TW..b...a...d...g...`...^...]...]...^...a...^...f..6|0.].^.l.k._.a.N.R.1x ..g..._...Z...[...^..I...L...)v...........T..P...5....RN..c...^...h..X.Z.g.i.j.j.U.W.c.d.v.x.K.G..k...[...R...R...]...h..7z7.O.M.X.X.U.W.R.P.*s...Z..E...L....|...5h......`..S...4....SG..c...b...[...[...k..3}

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020010\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1741
                                                                                                                                                                                      Entropy (8bit):7.282943200865706
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:QWHNn2qdIIhEhJ3d5eiPfmu+pYsjpHN8dCw:lt249+8int+pXpHNg
                                                                                                                                                                                      MD5:A640F4C64FB4808A4DBF2692BC409C42
                                                                                                                                                                                      SHA1:0B9CF0306C4839FED20F12BA509E265301CECD09
                                                                                                                                                                                      SHA-256:1C0DFAFD20B039526B3DA6ADB2B3A4D6D79AB5A2E4CBB22ED9692053EA9C789D
                                                                                                                                                                                      SHA-512:0CD3BF150CC5F45594AEB949218FFF0CBC06D44592FC60A12CB4DEA0C6ED904504E6DE9F8736F91B37029C63F0996AFBDD8E28C853AB3C65350967D9FBAD1D72
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134342, 2010/01/10-18:06:43 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5" xmpMM:InstanceID="xmp.iid:63D5451FFE5311E1AD2FFA46191422D8" xmpMM:DocumentID="xmp.did:63D54520FE5311E1AD2FFA46191422D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:63D5451DFE5311E1AD2FFA46191422D8" stRef:documentID="xmp.did:63D5451EFE5311E1AD2FFA46191422D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Ots...KIDATx.TS.o.E..fg...Y..7.7..4....P.....Th.p..pAH...w.\..8 ..{B.*.@.....Q.+$i......]..Y.X.ivF....}.^..e.xx...w..Z..Gw.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020022\back.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2011:04:28 17:48:03], baseline, precision 8, 1024x768, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):36409
                                                                                                                                                                                      Entropy (8bit):6.5813790191011785
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:VKmtNtJwR39MtZKdUgiO+t4mIfmhvn1a/95kqfRRMyIcw:d09ajKdUgiO+OmIfk1a/TM7n
                                                                                                                                                                                      MD5:D6B0C91234891452C249A3BCE4EE75A5
                                                                                                                                                                                      SHA1:782FA10107288338F3AD151F15BACE923435BA4C
                                                                                                                                                                                      SHA-256:AADD99E5465B69FF49F4745D20BA88AFC196B8143425DF3BF3F8897CA1BDEA9D
                                                                                                                                                                                      SHA-512:D2130E8F7590B8C2358FC831CB15529A1C77C8441E455B119F4CF5698B0A6FC338944A3C24E481EBC92B00D35C8220FD677183E9193BEA90D32BA3BD83D511D4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x..'....x..'.Adobe Photoshop CS5 Windows.2011:04:28 17:48:03....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................x...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..S.R.].U.Bp..(..(R.<%H.0..8O.R8..Kj&..J.G.-..R.+....Qv.-B...1j).$%I.DZ..R.HAp(.LB!.$!K.....p.)...p..L..+I\...@$...<'.<".c..J...la4).P.*.B."Bb.M.!D.R.HAp(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020022\config.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [AppSetting]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                      Entropy (8bit):4.98799339009139
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:xXsVVLjwVnDFJNNbUQ5ntIEE/MKAX8VXzALysqcs57Jwyn:psVVLkd7Pbd5tIEEMK88FA7srt
                                                                                                                                                                                      MD5:CF905DAAE5C004070EBD349716ECC479
                                                                                                                                                                                      SHA1:BC2A567CCE58FD7343441764B023B59D23883997
                                                                                                                                                                                      SHA-256:74CCD3D8E720295A9BCAA7A8FF292F420629E61D718E7AA258CD5C4B854FF090
                                                                                                                                                                                      SHA-512:89B9C36165C38230D17BE02D35E9CA208DB8E69835570C91C02913DB402C475034B65EFB0D1993C00429699B2CCE987ABD7BCAF883980146D39E7D928A41710C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[info]..id=41020022 ..version=1.0.0.1001..name=...........[AppSetting]..icon=logo.png..smicon=logo.ico..title=.........url=http://static.apc.360.cn/cms/mini/female.html..catch_img=back.png..width=800..height=600..frame=1..timeout=15..fullscreen=0..rclick=0..max=0..browsertoolbar=0..hscroll=0..dialog=0..gamead=0....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020022\logo.ico

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 48x48, 32 bits/pixel
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15086
                                                                                                                                                                                      Entropy (8bit):6.528254274979402
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:49hekd/ODFoHCkc+O/8bCyFoO47gojnHKC:4fexKHnO/5yFotkojqC
                                                                                                                                                                                      MD5:D3BF36DAC2268F5C5EFC74FE319E1A2F
                                                                                                                                                                                      SHA1:07F3E64272EC80535AD1E8B908396D94FF757C39
                                                                                                                                                                                      SHA-256:C121021AE242D8128A95C4DDCFA6EA651C6479263D7A4C2E936285C6609D3C45
                                                                                                                                                                                      SHA-512:7BD42380CA2BED8E9F0FF3E2AC7C6FE3F7981F9CF6C634D5FC5AD4F7263791F96698600D3BF53DE45B4E83B9C1A4522C61173D5DF686E8806F98707BAC60E544
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:...... .... .....6...00.... ..%............ .h....6..(... ...@..... .......................................................................................X. .^.%.c)".\A".Zg&.`.(.c.,.h./.l.1.n.4.p.2.k.5.n.......................................L...Q...V0..YA..VQ..Wg..Y...]...]...\...^. .`.!.c.".e.$.f.'.g.).i.,.k...m.2.p.6.t.:.u.9.u.9.qL......................5%..N...Z...Y...Z...Y...[...]...^...a.".d.$.g.,.m.2.q.3.q.>!x.J-..K-..T6..fG..hF..oM...Z..{U...l..~\..J"..O).,..............#$..J..._..._...[.#.f.C,{.S:..^D..\A..mP..uT..qQ...^...\..{X...a...\..|T...V..{O..zG...G..x8..{;...p...n..._..xW.b..............2...]...`...[.3.o..j...a..}M..tC..s?..t=..n3..h2..g-..a&{.[&t.Y#s.R.l.R.l.Q.k.K.e.J.b.J.a.O.d..H...h...^.................#...@...c...^.&.g......R..K.j.I.h.J.h.Q.p.L.i.M.g.L.h.L.h.O.i.N.g.M.f.P.h.N.f.H.].P.e.['o.S#h.yH...c...a...x..................*...H.#.f..._.`F......p6..I.f.G.c.H.a.I.d.H._.K.b.O.g.R.i.S.h.P.e.O.d.N.b.Q.b.zG...h...o...l...k...c...`...q..................,...J.&.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\41020022\logo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1090
                                                                                                                                                                                      Entropy (8bit):7.76613347959362
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:/REn/yTUsvAI2o+Zh2w28u6io330GZwL96cDUwhW+89:/+n/Y71+iw2Fo33JZ+Ecowhtu
                                                                                                                                                                                      MD5:F441D279A97A40FB7DF8353BA76BBD7F
                                                                                                                                                                                      SHA1:6EB2170AA2A9A989468B969FD78318A9713CD801
                                                                                                                                                                                      SHA-256:52D4D1D796EB2D4DE9BDA84DE6055CB81B1DA303BC6FCF70D5CEABBAAB716DE0
                                                                                                                                                                                      SHA-512:88BE0D88F553AECBBC9DCD6276F9063AD913F1237E733C35BC17F5A8C4BC34F4176AC4868E448455ED4D087E13FEB9A2BC92C7E460B86CA164BA3D6DC51807A5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O5S.L.w..M.....C...b.BQA..k.p..CD...t.R.RZ.>....8...XQ!.K.0..-.(...P.Mq...5s1..~.k.K......r9B.`........6.\.O.?..X..'........q[...b.}.Q.}.*../.....*......c..'..!0..g...=h.F........2jN....6..=.>.$tBw8.#sv.x..\.~....H..A....];.....(..~.L..7)..%.N/+...Z.-.r...(......nD~"..s1....eKP,.a.......U.be...9=.....f...x18...Q%.DlH*..Y...4......V...K(...TJX..|....k.......w..@..>.2.r../@.....r.+kqY.j.it...9....8.Yjz....=....{E.........B.j.q.S.N......s.A.g....\........F......... ....(..Ji%..l.:..B....)e.p..Nb."...T.P......$.<-.y. &8..P.....r..........A|H.j$..R{5..;lRe.}.~i5f.Mh..pJP.|.Q.y.Q.P.....[o.8O.............@...."s..m..0.7....>....MY.b@{.....d.p%....v..}.r.....\.q..._4.K.-8.~a.........QH...O..\+....#..`.j...'.'.....uA........RB.%...\..!.=.<Z8.>|t..a.G..4....n..6p.F|.p*....}.@..@.w........D(.<.=c........U0.i..s.0.G..!.........m].........~..E.u..A.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\InnerwebIDDict.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                      Entropy (8bit):3.5043173628520488
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:zULHloJmR50/c2JMd6oac3kovy/gJUVVTU01liovk9uSdXui3Wlj:orloJmbsdc0ovySUVz1Fk0SwP
                                                                                                                                                                                      MD5:9B55247FDDC635E389C1773C26533D96
                                                                                                                                                                                      SHA1:A329B3A9531DD1A4DBA52F05B3CB4189ACD6E3ED
                                                                                                                                                                                      SHA-256:7750F62A3EE34AF6C169B9378730C63B5BCDD4EC268F19B89EABD92E3EC7DCF0
                                                                                                                                                                                      SHA-512:4FC708A1E8CD948CEA21366B8F59F1E08E12442FC067AC679EE41C8CAD5BEDFB25A54EB8F0D78326304DAB41ED9F08E81AC9E37288A1E08CB6D1FCB973A72A1A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[iddict]..12=102395757..13=102395759..14=102395754..40000094=102397100..41000017=102395760..41010001=102395756..41010003=102395751..41010004=102395758..41010005=102397068..41010006=102352154..41010008=102395823..41010009=102352155..41010011=102395826..41010012=102395752..41010013=102395755..41010018=102395828..41020002=102395825..41020006=102395827..41020010=102395753

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Macromedia Flash data (compressed), version 10
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):266976
                                                                                                                                                                                      Entropy (8bit):7.998728725880561
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:0VMwepaMMxfO2mVuNxj5ZN2pxgmn+sbmMf25D5jFOKryKJ5h5RDCq0CX:Zw84E2MYj5ZN2Lgmn+q4D55/tZ5RWqp
                                                                                                                                                                                      MD5:C49D014473AA8C4265DF5F40E10582E1
                                                                                                                                                                                      SHA1:B9085447DA30288D6F71A1002903640114DDB9F3
                                                                                                                                                                                      SHA-256:28D4E173F02CEFC478F26AB9103C5D6983931D27EB36D92A286082B5419AC689
                                                                                                                                                                                      SHA-512:86B5F2A19E4083D0C44512E3A73C87C78C2A2F683A3137796B674256C937EF6A5F2D41572AFAB8664B5B0492E5616DED28F0B49D55549AF4308FEE78EEB4194E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:CWS.+...x.}.x..u...bq.d....V..I,.'I .e..$:....X....H. .`....|./[.%K.,[.O..l.e.m.....o.6w..t..I.^i............i.s.7o..f8.i...i..a.......5.O..o.5..K6..<....oY.k...,......u..@jZ.@.....,^.a.....Lnh./../...... ."i4-.............NQ..Y..Wj..Ze.|.E....8".ei...@..K..i...21.9..Y....^._i..&.#.Ln..o..T2.c..7...3.{7...E../..zq)cEa...$SyDEN9)..[...O{...IFO{.aR..XQ6.......5..7..@3.b+2.s"/g*..q..S|z(....v..LZ....,..h.,.-.yi.1.......f.)1.I.#.-.*:..-(...T..'S.-......`.B..u$...X..[gu........fp&....*...0n.....6.T...Y...a..i#bnH.f5.j.u..L.s.....?.y....}.;_.&3..._.%...3;XH.C.s....{...Co.7=.2..r..c.{.I....o...x....~..q...6...b0r.Y>..o}..]]BC.+........o..~.....p.S..._-..%...^. ....o..7.r_.....Oni........X...z..._.[...[..7.r.Z..;..Y.A..U...{..../.../....Wo%....Z.9....{K~.ez..m..%..].v.._B.........../......,.w.......]w...-....L)7..D............%;.1.W4..%.f..t..2..dz..<...... ..{.#11g...194,;..|.J.V.p8`-.~Q6.gsIYt.N.,$.l.....G2....~V&%YL.9./..0..a....6.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MsgBox.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):510696
                                                                                                                                                                                      Entropy (8bit):6.459926518380195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Kb+/Ln26GlBvxG4stUgGC9PkPCEFnKowWTa6Gh:n2HBor9PkPCEko7Ta1
                                                                                                                                                                                      MD5:486C38F163027600AB117D4D1BA6F254
                                                                                                                                                                                      SHA1:14997ABF08A3D2711209FC617D2AE91033AD8BDF
                                                                                                                                                                                      SHA-256:0F7DDE159F497F194267B1400C05DD9304805B6B6AEE2A923F86C6854C38C65D
                                                                                                                                                                                      SHA-512:65CD19982B9EAD7FEE58414B48D24F5BB99FDCA882E20A396153CA7BB10FA2F9FF15B6C97634EDB29E0AE5F926C5044382C8C45288E2520ADAF2F004C6DB5F2F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........)...z...z...z.Q.z...z.Q.z...z.Q.z...z...z..z..Jz...z..\z)..z..[z...z..[z...z..Uz...z..Mz...z..Kz...z..Nz...zRich...z........PE..L....P.O...........!.....F...d......v/.......`......................................._....@............................m........... ..<>...................`..XU...f..............................h...@............`......<...@....................text....E.......F.................. ..`.rdata..MO...`...P...J..............@..@.data....j..........................@....rsrc...<>... ...@..................@..@.reloc..(....`......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\MusicIEFrame.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):584000
                                                                                                                                                                                      Entropy (8bit):6.594932333601168
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:JGonh08rgTC/lBz7ZJJU6O0ksHXZwf5kbtwd3pMg0JeFR9Pz:JGcvroC1JJg0H3GYtwzT9L
                                                                                                                                                                                      MD5:45DB84CAC7279600FFE76EA7DEF6839D
                                                                                                                                                                                      SHA1:0FB498863ED8E0DCDD495D2171BB950CE6C614E2
                                                                                                                                                                                      SHA-256:82E0C1FF9D3E88715D36B2E05E66360434C7D0AF0F8CB28E299E156544093B5C
                                                                                                                                                                                      SHA-512:392ABF8B63E71DA621408A195CF21959D29521B8AF1F71521B06D4B89EF4A9562184F515FFA12C4AA46B8860DC9015C801042EBAC4204858FC2C64C433982052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i@N.............p.......p........C.......U......./......p.......p.......Z.......p......Rich............PE..L...].[Q.................&...................@....@.......................... .......~....@..........................................`...w..............@.......t;...D..................................@............@..8............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data...$N....... ..................@....rsrc....w...`...x..................@..@.reloc...=.......>..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\NotifyDown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ProfilePages\NotFound.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                      Entropy (8bit):5.153753018312021
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BMQbwECvy4C/KW6QclfhfSwBZSSnzx3qK1QhZYovpY5EkqfAe/+RC+PGb:Wbvy4mspKwBYOx3rufvpDh
                                                                                                                                                                                      MD5:8DB7B7ADC2434F7113E132AF65516176
                                                                                                                                                                                      SHA1:A673FB04DE1C725B02F38358C76085EDE1100924
                                                                                                                                                                                      SHA-256:753DA32F2D7ACF559AE1E1B6B17902A6E70DF03A26DDB6ED48B840CF63F322C9
                                                                                                                                                                                      SHA-512:4C1BFC0AE4C7CDF02AA1B22303CAFDB17BAD6B590624CC90A906EE7AEB289E0C58B9036B66672ACDDF1C8162D4B5BBBD8BF36AD8201FA8797CC9C58819C0F535
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN".."http://www.w3.org/TR/html4/loose.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">.. <head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.. <title>.......</title>.. <style>.. .*{ margin: 0; padding: 0; outline: none; }.. .body{ background: #F4F4F4 url(static/img/bg.jpg) top repeat-x; }.. ..box{ width: 340px; margin: 150px auto 20px; }.. </style>.. </head>.. <body>.. <div class="box">.. .<img src="Worning01.png"/>.. </div>.. </body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ProfilePages\Worning01.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 340 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):17565
                                                                                                                                                                                      Entropy (8bit):7.962857909173445
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:e50wzg3DIjLheUt1F75AzFDEj121sBqbOQJixQl7y:EtgEpeUXF75gFDnaeRfle
                                                                                                                                                                                      MD5:749674F1108D9B96B22DC4EA6682B52B
                                                                                                                                                                                      SHA1:D1AAF059EC5D6D658B2C6D769DF0B7435F8186E2
                                                                                                                                                                                      SHA-256:7CD864C074EF42A0C313BB6CFFBAD6B0F1C98636C988F5CFAB15C634CBE38BFB
                                                                                                                                                                                      SHA-512:F945A2C67C8984C65CE444AE222BD53002C1CBDECB5077EDC361E14CA730F962576F97982E90FAA5FD9F03C62A93D3FE3795BF324BA3B3E81C417BF1DA481526
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...T...Z.......q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ProfilePages\mhead.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 64x64, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1482
                                                                                                                                                                                      Entropy (8bit):7.6740054408978375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Bj4sozuzo0XxDuLHeOWXG4OZ7DAJuLHenX3sPLOaIdXCbfVEy1eA2w/vf10f77h7:Bj4/zXuERAGTOaI2fVEbMqf77P2N0Yc
                                                                                                                                                                                      MD5:21F120093FDEFB193952E0ACE4066C25
                                                                                                                                                                                      SHA1:450D74C4E80D71225D39E2C71C770805DB683AAC
                                                                                                                                                                                      SHA-256:6AB4571EAC204EF29DCD9D7CC3CAE54E12D77105B568DA7C43324FDB0DCCAB6E
                                                                                                                                                                                      SHA-512:EA328E8E27DFC949B9EECA25C9AD2C1C56B56ED9DC43D6998CD197E5717F857D36A82A408A4E545BCB928E6EECA56DF653AD7F1D87BD2730742C10408C389451
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d.....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......@.@...............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(........I'.@.Rx.f....f.*p]~T.._emd.s..v....;.B.Q....F.@>.).4.......K./m.{iVH...M;3h.I].R((.=..p.@\..It..z1..2..._.........1k...w.=.z'..../.4..+&A. .+\.m...i.I..0O.p..{....\.9.7..;-..w.7P.!.N..,./..,z.1......E;r.u.......].,.....>.2.?.s}q..#....j.Q...v.....0.s(a..V..l...J.Y.....E...UX...E..n.5.1+..V.h.,M\S2...0.2.N....}.D.. .Z..Z..-...=.&T..[.]-..".th.S.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\ProfileTip.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                      Entropy (8bit):3.880179922675738
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1+R6VTN5n:1+RwTN5
                                                                                                                                                                                      MD5:8F32791CB5F457EE0C149C984C58086C
                                                                                                                                                                                      SHA1:710BE60DDFBD5ED741DCF262E8B8D6F29CF8BB89
                                                                                                                                                                                      SHA-256:4B46A343C434C7A227A904D743C47BF4232777CD85A55DD98C11F874AD9E980D
                                                                                                                                                                                      SHA-512:6B992B556A1522DC2849667A565A1553FC8E68A25023A6220F7E762777F1A70C5FE031B0A2829F670692767D68C128570646828C952850997289EC61DC32A113
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..main_switch=1

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\0.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4502
                                                                                                                                                                                      Entropy (8bit):7.913847232220015
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwn/ea+W+62BxX07:/ShuweflgTMEEO0nKZ1R8ehBxk7
                                                                                                                                                                                      MD5:03443B5ED06C4C0578E49FA140B1C6AE
                                                                                                                                                                                      SHA1:0BCE94FA69102EA0CCDA90E42EFA4C070895426F
                                                                                                                                                                                      SHA-256:A3AB9D0CC16B534EEE0ED9074CF0001EC13C47FAFB2ABE5A77C410DBF38ADC7A
                                                                                                                                                                                      SHA-512:9E557DF066DD9B8285A141EEB483783C649E425A088495BC2DB9B2EB18AD1141F98F71EE049196FCBBA1428573938D9F020358D504A1C08EDD044DBBE614D867
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\1.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4720
                                                                                                                                                                                      Entropy (8bit):7.910929199552645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwQ9IYDFUcX/Il1TXQNtWoH:/ShuweflgTMEEO0nKZ1Rf9IYD+I/O1Ta
                                                                                                                                                                                      MD5:82C2A66ACA005AE47EFA6CE326ABFE76
                                                                                                                                                                                      SHA1:1009671F3A2397528232F773590F251B1361567A
                                                                                                                                                                                      SHA-256:A78939D1E1822D661C18905BF4FF002B069FEEB9E2B61443D6F8BED68F4BD3D3
                                                                                                                                                                                      SHA-512:1E66793FEF142158EE9F767BBE66D3020A200113644D76A3E9F0BD0A07A19D0A645870F911B1A19086F7474043A1A04F17812CF76F4C7B5FD9EBF996E0967599
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\2.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4745
                                                                                                                                                                                      Entropy (8bit):7.906551448003165
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwA9EHczkCM5yRyM0ADjr5:/ShuweflgTMEEO0nKZ1R56HfCDRyzA3N
                                                                                                                                                                                      MD5:C948EB58717C808198DCB2253535C068
                                                                                                                                                                                      SHA1:1E9FA3456ED43BC6F1688D38B44F28C5BB79F76E
                                                                                                                                                                                      SHA-256:D78BD49006A2AAD356F7C043593256241A4FC2A7E63890002BA840BAA1027BBB
                                                                                                                                                                                      SHA-512:E2748AA2D7EB462FB9B21E408A479B993A52B5DA8499BAAD6686F8DEF0FE7AB53B1D7AD686BA7174E85A2C08F64D1C52D4518443849209BB940C943F1796E506
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\3.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4784
                                                                                                                                                                                      Entropy (8bit):7.91968879390982
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwnhfMROht+7hLUBvVqOmEw0K:/ShuweflgTMEEO0nKZ1RkhghgQw5K
                                                                                                                                                                                      MD5:6FAD4397D817D28386B5888AF6E596F2
                                                                                                                                                                                      SHA1:7922E4782457C1478D85B14D5DD44F3420A16076
                                                                                                                                                                                      SHA-256:59394F229FD727EE54E4A93FC607249FB79C4E1CED49CD55C5F36D07D9F493F7
                                                                                                                                                                                      SHA-512:70AC2D8BE829BB7B021211F83E71E3C1B546C8A9DA72A0F323ACFA6E8884D72AA64C097A2B95FBD7E0D133D0BC48E73F69D95B956C2DC616454083633FCB7994
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\4.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4833
                                                                                                                                                                                      Entropy (8bit):7.915121783505522
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwY+6DKmz4RH7/QUBCx18Oi6O/t7Ie:/ShuweflgTMEEO0nKZ1Rf1uFH7/Q2C3e
                                                                                                                                                                                      MD5:D9BA67EF6CFEAD7F1A62E579904241F9
                                                                                                                                                                                      SHA1:98C13A03B56900C28E4DB7DB13A807D15F7B0AA6
                                                                                                                                                                                      SHA-256:80199A066CB6E29A4131F034E92A22F687E097554FCD15D0497B6553BA04EB28
                                                                                                                                                                                      SHA-512:434D4617638ACDD0A505A6F47613632FA7846F5857B554399393D716BE43F741A08C36E40219755A21A5764CB4348093BF6184B492A4445E5804C10DCB4CE2A5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\5.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4490
                                                                                                                                                                                      Entropy (8bit):7.914756290833229
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwB+/ZRK0UhYQ12wau1:/ShuweflgTMEEO0nKZ1RI+T0x2wp1
                                                                                                                                                                                      MD5:F8D45187D602D6B6BA49A4460695EA55
                                                                                                                                                                                      SHA1:DFDB711F7E5AEEA31D41639E0477F4A7DFAFC0A1
                                                                                                                                                                                      SHA-256:140347F6A1F50B6827359EF961F31CF7F7FB2B800FD730C21AAB437FB1EB4905
                                                                                                                                                                                      SHA-512:E1382EAF8A4BBE93A48AAB86E3765133AD841CDB74D2C7B78B053DB9CECEDAF41E0425FE9695A1B1CBB386321B4BE919FB94603988D7658806ADFA7FC0B7121E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\6.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4628
                                                                                                                                                                                      Entropy (8bit):7.9134281959066355
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw7DTfI/ya4WfUiW0B042od8:/ShuweflgTMEEO0nKZ1RIDSxfUiHB04k
                                                                                                                                                                                      MD5:6EE23E80FDF87305D823AF28A755F479
                                                                                                                                                                                      SHA1:F1F5AEB82A11407B46EF88171B0CE6E32BA33515
                                                                                                                                                                                      SHA-256:B22B3DBE0B1EE0865A44343C598042E29B05A63E4647454ABE288F3612B1BF00
                                                                                                                                                                                      SHA-512:FF2CCC273A063BF4D3F302FDC8384D63035EE8F071DCBEAD710CC94C173764B331ED26C356E5BF688B7761555CDB263405F2B88F6748D4A70CC380701A868C5A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\7.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4450
                                                                                                                                                                                      Entropy (8bit):7.908145383039164
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwmWJ8muaMMYpnUF7WavfP:/ShuweflgTMEEO0nKZ1R2Jx/Mq7WEfP
                                                                                                                                                                                      MD5:714DA01FA83B494EBFC4B0431A435578
                                                                                                                                                                                      SHA1:A03B48EED86BEED3302D638967C2321532A4786E
                                                                                                                                                                                      SHA-256:BC7A1749B485C7DD596E47AD2C333AFD4C618D4BCB6AC778AD22D2021CD5DE81
                                                                                                                                                                                      SHA-512:1BE5417627205B56365963C6987E1AB0DC2E7EB8FAC2216491A4ED0FA77C354C7017CA80C0F75106EAAB9C27BC836DCF6BC72BCAD4DCE91D0D21835F348B3E48
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\8.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4500
                                                                                                                                                                                      Entropy (8bit):7.917985621284803
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZwWa8zQiPJUBoMdpWAc0m:/ShuweflgTMEEO0nKZ1RK3mUBoOBm
                                                                                                                                                                                      MD5:A1D584A6F5E61C876A18AB41838167E3
                                                                                                                                                                                      SHA1:32338EC7EE370EEAC323D7F4E08445B0E034F083
                                                                                                                                                                                      SHA-256:2F818AD9FA9E8022846E67E1B7D3B63530FB7CD5AEAA82FF6331679D11EF40EA
                                                                                                                                                                                      SHA-512:017B8CEC7199EABA9D2AA1D8442AEAFD134E4C461DCE436D71D92AA2017E7ACCFDDE325DF8F3876F65BBD64D86A910766886698415A0A04D1D6CCEE416270672
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\9.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 81 x 31, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4252
                                                                                                                                                                                      Entropy (8bit):7.914745740309695
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:/Shuwefl0m+TZjyEEqcTo0nKZx3RMCZw8ahU0JOI/nfAMB:/ShuweflgTMEEO0nKZ1RKU00IQM
                                                                                                                                                                                      MD5:C49CA4AF0CD038C8E94AE523BAF96AA3
                                                                                                                                                                                      SHA1:6A5DB9C4D78D1ADE228D589402669CA798F49055
                                                                                                                                                                                      SHA-256:C6CD29C7CA458D53F98E05531EE0DB54162A07676A93EB7ABAD5DD612AE262D6
                                                                                                                                                                                      SHA-512:04FD518735E92B4B495A0B3402477E31C25A414B96E32923280E1CC4B9A7758A19ABF3C9453D63F7E1976B9D4F9F9195E9ADD5D8CBB0239EE3F0B4791B2F93C8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Q............}....pHYs................diCCPPhotoshop ICC profile..x..gP.Y.....:.R7M.&.,Yrl. .D...m.4.....c@E.L...c.d..(...9..2(..`..*..g.v.l...Su..:u.y.....Nr...T. S$...{.c....~@..2..F\^..3,,...&....p.+.g..'y~r6.....$~6/..9..c<.D....@.R.X..I..).....6..S0....L..c...D.{.`..$..+..P{.....H..c.`%..E.46...R.|.Z"..ef....J..(.o9...L...r..<.... ........VfF.......2......F.\....g........%......_..}...8,r..R....d...q..fX...5......F....3...83,.rfg./.......\.I..I......K..T).S,.H6csD<.3......?)6..=M.X.......j.p*.@..=....g.....[........I......d..*...`..`....................X.............p...Q8.-p...e...p......K....D........h!..)b.8"n./...#qH""@DH....CJ.2....#?#...H7.<@..Q.-...P..D5P...uD=. 4.]...,4.-D7..h.z.mF/...;........b,L.3..1o,...R0...+.....k..[......#..86.....E.x.,.*\)..w.........p..t.:.....c...R|...........?.. ..,.!...@.#..V.J...M.vB.a.0N$.U..DWb(.K......G..7...$*I.dC.#.D...r.a.9.M.s.$Y..Ov&........Zr...y.<I...R\)..4..J...r..OyG.Ru.N..T!..ZA=F.B..~.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\PswImg\PswImg.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):150
                                                                                                                                                                                      Entropy (8bit):4.496733935873367
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:QA/oeLl5VgC6fU/ubC6hNvJPhiM9TERQIC6IgBEoAovM4KgxeJvn:QoLl5kkubC+BHsQICfEEdHpoeh
                                                                                                                                                                                      MD5:F381D25EDE8E75B43B15812D34639F31
                                                                                                                                                                                      SHA1:4737138A26DFAC9A951EAA61284C474BF9E91D33
                                                                                                                                                                                      SHA-256:2CD7942D3CC2E3B374AADFCF8845546680B4DBC7CD49D939C9B8FDF1E30F92A6
                                                                                                                                                                                      SHA-512:402A706B8A885EACAD5F704028CC7CE38EA982F25FC03F557AFBCC0416CED2A1796501FC80BC337161DCFE4C692E19667010E820FDEA1D336F91D3D08E371E91
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[images]..count=10..img_0=apple..img_1=banana..img_2=orange..img_3=pear..img_4=tomato..img_5=beef..img_6=noodle..img_7=rice..img_8=fish..img_9=pizza..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\RegSMWebProxy.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):94360
                                                                                                                                                                                      Entropy (8bit):6.439301229562193
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:EBw4ZQDGLJpVScRDdF26vamLBOgm0j4kLcq+UL1nINzs5FKSXssRwCaM:lVDGL4MRTLp91VQs5FKS8vM
                                                                                                                                                                                      MD5:65CBBA195B71603A4FFB7F7F85CB100D
                                                                                                                                                                                      SHA1:867AEF9332BEDB8A226EA43B711F7C39B77E55D3
                                                                                                                                                                                      SHA-256:9A95725D30B843B195EAF7848B5A1F45F9542C3607F1F394EFC00840D1D2D61A
                                                                                                                                                                                      SHA-512:7A539AAA037B05B960918B635D19AF4538468B280AFDEA747AED9E3E7A9EAD71C44DB2C594C9C91D2703F85969A86D3D654C5AC93A117E873C1C7BB093A253D3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..J?.u.?.u.?.u.6...,.u.6...S.u.6.....u.....4.u.?.t.L.u.6...5.u.!...>.u.6...>.u.Rich?.u.........................PE..L....q.O.....................t......QD............@.................................S.....@.....................................x....p...............T..................................................@............................................text............................... ..`.rdata...5.......6..................@..@.data...|=...0... ..................@....rsrc........p.......6..............@..@.reloc...............<..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\RegularShutdown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):478584
                                                                                                                                                                                      Entropy (8bit):6.539196463495275
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:5BcE3okNxTv2eMwmQNSrv4t3VNZ7G039tS7:5XTMqtFf39tS7
                                                                                                                                                                                      MD5:F6558ABE236AC14E95A2CC9E8016F10C
                                                                                                                                                                                      SHA1:422F19A783888188FA4E893BDFC4F49F8153BDDF
                                                                                                                                                                                      SHA-256:353FEF1191DE8CCE7F9D65C221BB6545AAAD188F29C377CAB7A71BB6E6DF2905
                                                                                                                                                                                      SHA-512:14C3679BB468300867CF8B07558BDD2CA31CB0FD5508C61B2BBDC5C4E8C447F82CCCA80B0C87A1D551C161E2187663DB698A7DCC9BE3F56603B260B43B631F1F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_.._.._d.M_.._..N_..._..X_l.._..__..._.H._.._.._.._..Q_.._..I_.._..O_.._..J_.._Rich.._........PE..L...l.(P...........!................^.....................................................@.........................P.......|........................8..x.......LI..................................X:..@............................................text.............................. ..`.rdata..............................@..@.data....O.......0..................@....rsrc...............................@..@.reloc...h.......j..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SMWebProxydt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):192888
                                                                                                                                                                                      Entropy (8bit):6.456073453336491
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:fVL+cTZub2RsvU8r9sa4/xzzwZ+jVdcAnqC790CN9rv+2YfyAI5/Tqig0X:fTO2orY/xzkSTbnqDOlX
                                                                                                                                                                                      MD5:7520A23D749D16BB35C00B866A875E4D
                                                                                                                                                                                      SHA1:3CF93090606C7F904DCA566B6E63496CE4A9462F
                                                                                                                                                                                      SHA-256:C5544BFF662C1C45E32DFC774A9CAEA117B3FFD9232738150319A43BBBFC4E1E
                                                                                                                                                                                      SHA-512:811FDCF2D28330B1FB7D8EB961972EC3302AB4A3BBAE1B8488C86A72CE0820BD057CF64EECA9B208F9D263BBD883D3B91F676AB81AD247DCA031B7B15179D133
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a..Xa..Xa..Xh..Xj..Xh..Xx..XF[.Xb..XF[.Xv..Xa..X..Xh..X1..Xh..X.Xh..X`..X...X`..Xh..X`..XRicha..X................PE..L....`<P...........!................-........................................ ......l.....@.........................`m......@^..........T...............x.......\... ................................@..@............................................text............................... ..`.rdata..N^.......`..................@..@.data...|L...p...,...b..............@....rsrc...T...........................@..@.reloc...4.......6..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SetupUtilDT.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170344
                                                                                                                                                                                      Entropy (8bit):6.515376474233682
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:X8cE5RULjRoG6LVI4P7+lLdoL6qY0foiStJv5LULIebzLo:Xb0RUfaGiI4P7+lLKmswRPtlG/o
                                                                                                                                                                                      MD5:301A4BCA1A602AAD88C5E21AE2A8322A
                                                                                                                                                                                      SHA1:73AEAF28C654C8AE61BABD5681160783520F5963
                                                                                                                                                                                      SHA-256:977B181508CDE3EFFDE19A22B03127626AF6D96B6ED0B29B7AFB514B1646672E
                                                                                                                                                                                      SHA-512:0A00B9274485FC4CA8EBA9BA90161AEC950034804076C79E4DE7DF76E971FFF179349E4BF6F72EF4F53D357E2D5D19584B7322C9C8D2DD1DE55BF2F1FBE22209
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eqz.!..L!..L!..L._.L ..L(h.L6..L(h.L...L(h.L...L..oL6..L!..L...L(h.L0..L?B.L ..L(h.L ..LRich!..L........PE..L...R;.Q............................=.............@.................................u`....@.................................LE..........................h...........................................H1..@...............<............................text............................... ..`.rdata...R.......T..................@..@.data....3...`.......D..............@....rsrc................Z..............@..@.reloc...$.......&...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Shell360dt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):143680
                                                                                                                                                                                      Entropy (8bit):6.431961396973279
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:DO/okRPCVM811+40nXrTwSmyOv54lJ1b92q/5l:DO/ouPYM81QnXrTxldL
                                                                                                                                                                                      MD5:2886F9660FC089ABA2443F39D17325E9
                                                                                                                                                                                      SHA1:152EAD0B9248BD91A2AD5859F66A61D8F80C42F3
                                                                                                                                                                                      SHA-256:CD72A2A410DDD4F9EF32A191B1E7C95833DCEC2547F559CA0BA86B81F25183EC
                                                                                                                                                                                      SHA-512:B1DBF94CCA19477D86FC1489311A524C8B21629BA38B13531D2560E5ED54CC9946336E63C424E03B2AF4E12E77BB8E333BBE4123738E660771BB44E092074A1F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...-.=.5....V.'....V.1...$.......-.,.d...-.+._...-.:.%...:.<.%...-.9.%...Rich$...........................PE..L.....Q...........!.....\...................................................p......s.....@.............................3............ ..................@....@......................................P...@...............t............................text....X.......Z.................. ..`.orpc...3....p.......^.............. ..`.rdata...U.......V...`..............@..@.data....3..........................@....rsrc........ ......................@..@.reloc...$...@...&..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\Shell360dt64.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):173680
                                                                                                                                                                                      Entropy (8bit):6.219447336142119
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:Ohklszuf0QeZ7Gf+oCKcGs2U80sWLGk+tg7r9yku5M2Tyl+l3:Mgsaf0xx7obcGsRd6kugfW2G
                                                                                                                                                                                      MD5:3A3848AB6721964EA1A2234295A95A53
                                                                                                                                                                                      SHA1:4615743A3085D28D3C90BA3B45C2EC35CF6EA512
                                                                                                                                                                                      SHA-256:90DAAB3EC9710B8CCACE6C5AE78F4ADC593DADB409115A59C0A2355E5ED3DCE5
                                                                                                                                                                                      SHA-512:E3D208F04ADB96B0E6938284C20D196BDEF3F44AB8B7F0E9882A70FBA71F333A3C45A7E801B3F7B1DB38BCF1EDC1090F58227F26042A4FC15AC9CA7D54EA54C6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E>..._w.._w.._w..'.._w.&...._w.&...._w.._v.._w..'.@_w..'..v_w..'.._w....._w..'.._w.Rich._w.................PE..d...l.Q.........." ................................................................0.....@.........................................05..4....$.......................p..p6...........................................................................................text.............................. ..`.orpc...5........................... ..`.rdata..d...........................@..@.data....@...@......................@....pdata..............................@..@.rsrc................J..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SoftMgrLiteBase.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):224768
                                                                                                                                                                                      Entropy (8bit):6.287026084352163
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:AGD6qutYgGVwas4sY1qvp+bGotGedb1YZI/sN1uxC+pl5eP:iqut4eazsY1G+bGoYMbiZI/sv0SP
                                                                                                                                                                                      MD5:29BDF546B35C9348B0548697EB514AD1
                                                                                                                                                                                      SHA1:FFD42914C242016313413F8F21E96DB6B2F7D53B
                                                                                                                                                                                      SHA-256:A081598EB62B3339C9F548AE7EF4E1119A6CE25ACDC2CC7E1C93282E0B10FB18
                                                                                                                                                                                      SHA-512:C8FADEBDFC24D14FC997D75105BFB8389DD04C080D7024C862F8927A3D718DAA6C543C4220FAB01EE68911A7E16E4535074D7BDF0E4053A57D7B563718ACDEB3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:...:...:.......;...3...(...3...|...3.......3...5...:.......3...7...3...;...$...;...3...;...Rich:...........................PE..L......P...........!......................................................................@......................... ...x............`...............V.......p..\.......................................@............................................text............................... ..`.rdata...^.......`..................@..@.data....>... ......................@....rsrc........`....... ..............@..@.reloc.../...p...0...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SomSoftMgrdt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):313208
                                                                                                                                                                                      Entropy (8bit):6.466680083448089
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:yk6s0aqVh3w17APg2/9Zdq3wExVa3gc7wN+0/8cXtnhCK:yk6s0aqXw10Pg2/9AR+3gc7wkNc1hCK
                                                                                                                                                                                      MD5:98F5B324441C8C5B05CF3B2A16F9320D
                                                                                                                                                                                      SHA1:731BB8172FED108D6CB4593CA099E252F531113A
                                                                                                                                                                                      SHA-256:5CEC3C7FBFBFBA930F2B8E5FBC50E0405538CC8A5A71F61B20F769268B6C968B
                                                                                                                                                                                      SHA-512:E3B04CB980393E0F87C2688AA1158383785E08D286F6355C82568FD4031C5051D1B2D531DE0D428F4F3E0CDEF6E5084128668ADE27DA6120FC4458141777F605
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*z..*z..*z..#.:.<z..#.,..z..#.+..z......%z..*z...z..#.%.%z..#.=.+z..4(;.+z..#.>.+z..Rich*z..........................PE..L...S`<P...........!................................................................=/....@......................... d..I...dY..........................x.......$%..p...............................P...@............................................text...2........................... ..`.rdata..i...........................@..@.data...XD...p...(...L..............@....rsrc................t..............@..@.reloc...7.......8...z..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\SwitchBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                      Entropy (8bit):5.079869260421707
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/Xe/JEm
                                                                                                                                                                                      MD5:1F05485C8727776BF26D8526459EA5F6
                                                                                                                                                                                      SHA1:630183FA53BA835F49D56674B85C294568578F7F
                                                                                                                                                                                      SHA-256:6CC5460AC784DCF9B67071CE2DE1BD887C8796F2FFB065087EE80AF11DFB93DB
                                                                                                                                                                                      SHA-512:FEEF85BA05D3A61AF4097989A42CADAAAB0EBAA6B2755423B100D81885BD9AD55AEA46920B3EE4EF91DF15ABBB7FE9550019F9A9A666AC3B8B4C438A6E58304B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\TopBar.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (412)
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15013
                                                                                                                                                                                      Entropy (8bit):5.38113880966247
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:a0QmCW6FVyFK4eRepuA4E/GOf1k+o+gel:9EAo+
                                                                                                                                                                                      MD5:AFAEFAD34224A518FF330715B3D0810B
                                                                                                                                                                                      SHA1:137D920AACAE0BE36DD731B3E7D23E4F368F0FD8
                                                                                                                                                                                      SHA-256:9009EF748E3BE66216138DD2BD70A3C37A77E84333EB6585C78464F06091035E
                                                                                                                                                                                      SHA-512:2D8D4E16205DF78A1F8C3D94AE5C09FEA5A0D56B1AADFBE8CAD86E70D94CAEDC0D29976878046CD88B462773BAA73983F50F8671B086B1FAB6C13E9F677CD38C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<TopBar>..<Config>...<BUTTON_TOPBOTTOM_OFFSET value="30" />...<BUTTON_UPDOWN_ANIMATION_TIME value="90" />...<BUTTON_LEFTRIGHT_ANIMATION_TIME value="90" />...<BUTTON_HEIGHT_DEFAULT value="23" />...<TIMER_ID_SWAPBUTTON value="100" />...<TIMER_INTERVAL_SWAPBUTTON value="100" />...<CENTER_GAP value="220" />...<TOPDIST_FIXED value="4" />...<FLASH_FLAG value="1" />...<_360IMG_LEFT_POS value="96" />...<_SYS_IMG_LEFT_POS value="13" />...<_LOGO_IMG_LEFT_POS value="7" />...<SHOW_MODE value="1" />.....</Config>..<ButtonDefault>. . <Item ID="1000" Enable="1" ShowText=".." ..From="1000" To="1040" Remove="0" Side="0" SID="50" SortID="1" />...<Item ID="1060" Enable="1" ShowText=".." ..From="1060" To="1060" Remove="0" Side="0" SID="100". SortID="9" />. <Item ID="5120" Enable="1" ShowText="...." .From="5120" To="5120" Remove="0" Side="0" SID="2

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeature360Control.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):452272
                                                                                                                                                                                      Entropy (8bit):6.546876372610879
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:CIx7/JbPCSozzrRM96+V5/sXNsCyBq7FnBvSfSEBoeUICKZMeXGMIrqj5qrf:CIx7/8rnC96s/U97VBvS6EBgInmeXGMf
                                                                                                                                                                                      MD5:88DA47DCE2422F5CA1EA8CCAF94B0CD4
                                                                                                                                                                                      SHA1:EC6E45CBB75E468F421AE51378705A1177FB232D
                                                                                                                                                                                      SHA-256:C0443A671EE72A09FC18942D77A34EBA73A8FE7619144756C9AB019244F24FFE
                                                                                                                                                                                      SHA-512:631AD4A19B70D5F02E53D63134DE901C0565EBBC47DA3B9B9492A6C1A0548B7311411CBFD668CB5929C7D33D53A1893AA5D1EAE1DEFA0AEA1ECF51177DB1E489
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}t..............d.......d..}....d........w.......a..............d......d.......N.......d......Rich............................PE..L...GYRQ...........!.........................0............................... .......v....@.........................@G..\....7...................................G..@3..................................@............0...............................text...~........................... ..`.rdata.......0......................@..@.data....@...P...$...4..............@....rsrc................X..............@..@.reloc..pm.......n...^..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiFeatureKernel.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):339632
                                                                                                                                                                                      Entropy (8bit):6.596958488639138
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:bSMhbBN0RPgKmQs1wOWTxApJyL1l6niUG+VbNkrk908OI8a+gKeSjt5rPxrCmEaj:bSMhNWRPglwVTxAQ1l6niUG+Vb6rk90P
                                                                                                                                                                                      MD5:7BC5C0F13A513D3C14432C20DCBFBC6F
                                                                                                                                                                                      SHA1:086A8E486DC1816C07C2F59015BC7F61408C19BE
                                                                                                                                                                                      SHA-256:18E443B2582C0B04C92A3A9856F339AC8105AC5F31ACBFAADCA18E9FB74C08E0
                                                                                                                                                                                      SHA-512:F60CD9D94BD94B740379C0C9736E98048449793894633C13CE39EC4981476ABE9AE239663941844141B2171C30EED0CB350893A82C7B87ABC85C7F7098E3119E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.O.).O.).O.)...N.).F...X.).F.....).h.G.N.).F...y.).h.D.N.).h.R.^.).O.(..).F...{.).F...N.).Q...N.).F...N.).RichO.).........................PE..L.../wQQ...........!.........*......t........................................p.......0....@.........................p...[...l................................ ...+...................................r..@...............<............................text............................... ..`.rdata..............................@..@.data....;..........................@....rsrc...............................@..@.reloc..vA... ...B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiPluginCake.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):113840
                                                                                                                                                                                      Entropy (8bit):6.4167169275089755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:C7gXG24dB7sp1yJP0HwAr8QWTiRIx6PFt2vfpmwXsiDcpBm6jdS53gCUz:CyG24r7sp171m9xut2vfpyJ86ZS53/U
                                                                                                                                                                                      MD5:A609343C55A99F18637A839C747B5100
                                                                                                                                                                                      SHA1:93EE2A5E2AC2E8F5EFDD81E3D20C0EED9789D759
                                                                                                                                                                                      SHA-256:436EDC59FADFE1E79D1298C4279B01AB78D05A90AA8994D18DAE9947F74E63F0
                                                                                                                                                                                      SHA-512:9ABF899138248B381F82AF9DF1A16223B7270201D28427B1F8F065DDCFD7F2E5362C7E6768D7B1019BBFAB0263053910D2AD7A4ABDEB8044FD39EEC2D65D3A12
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sk...........j.....j......j......h.....~.......n...j.....j.....@.....j.....Rich....................PE..L...'H.Q...........!.................s.......0............................................@.........................`t..~...lh......................................p2...............................U..@............0..$............................text............................... ..`.rdata...D...0...F..................@..@.data....0...........d..............@....rsrc................x..............@..@.reloc...".......$...~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UiPluginManager.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):120
                                                                                                                                                                                      Entropy (8bit):4.816812756484348
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:OrzO0QgoaMMVOvrZD9nmL1BqXJOcbovJME/i0QT:OrzfmHMKdD5bhMK+r8
                                                                                                                                                                                      MD5:9D760ACF3E40DB21B6BACE47613ED99B
                                                                                                                                                                                      SHA1:9B6ED5516A091B70D045ED648975A3BCC4C0D5F0
                                                                                                                                                                                      SHA-256:CC520066B409F4A53D8A42DB2935DDAD7D44F5435669BD91745671C62FA7C646
                                                                                                                                                                                      SHA-512:40E640D2D9DC833C94CB925017A0B2545BAB8DD049C923015C490AD2A911D642370D110DD14C9F1AFFF6702C9C729A39CC3D76E5B073066D5CBE630E532016BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<360desktopui>...<virtualui>....<plugindll path="UiPluginCake.dll" virtualid="2,3,4"/>...</virtualui>..</360desktopui>..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UpdateTool.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):104904
                                                                                                                                                                                      Entropy (8bit):6.415069485363196
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:IhlPjE30TlqLk62khxYOR8HIfsgjy8Lw1MACpfKT6FTS5iMVnwCaR:IhBjJlqLl49GpjHLwEfjFTS5i2nuR
                                                                                                                                                                                      MD5:9882B5CB410EAD9CBF994D3473E042F9
                                                                                                                                                                                      SHA1:C20212130A3A209104D8E7031ED8108E42D56C1E
                                                                                                                                                                                      SHA-256:170B0F6255D1F3B4A8512353ABAA59D2B89D95D282F630782D7AD1721C849A66
                                                                                                                                                                                      SHA-512:A0815915D407C46115719CD5D3B569E5F8D26FCC8BF46339C830E24242291BB961012A24221E08937D1AEA434BF4D17B13EA5E75693F657FE2B396AC5B165FD3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............g`\.g`\.g`\...\.g`\...\.g`\...\.g`\..\.g`\.ga\.g`\...\.g`\.5.\.g`\...\.g`\Rich.g`\................PE..L...}..P.....................|.......n....... ....@..................................S....@.................................xO..d...............................p....!...............................@..@............ ..t............................text...c........................... ..`.rdata...7... ...8..................@..@.data...`>...`..."...>..............@....rsrc................`..............@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\UpgradeData.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7826
                                                                                                                                                                                      Entropy (8bit):5.42976700450195
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:nGCue4Iloi2j01agw4DEyz2sDRexJ6Y76zvEfU4rq:Gde4ooTjsREMJY/U4G
                                                                                                                                                                                      MD5:EA8B5BFF11632CAB8E693A9C7FDF7472
                                                                                                                                                                                      SHA1:6341165C54C982F777986CF2C6E43704DBC1D6BF
                                                                                                                                                                                      SHA-256:B297A10D0A79FE0E0C854207A266CCEBEAB41EF306F6F49AD0AFD18FA54EC21D
                                                                                                                                                                                      SHA-512:BB110E94AE179C0E19FB005AAF5E34D497A2114C56D3F99700B22ECA671AD3BD6B50C8F75D74C9239BDC7D83C50BEFFE900BA800D4D85B3A8625E90B1485ECE6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{..."local_app" : [40000011,40000012,40000013,40000014,40000015,40000016,40000017,40000018,40000019,40000020,40000021,40000022,40000023,40000024,40000025,40000026,40000027,40000028,40000029,40000030,40000031,40000032,40000033,40000034,40000035,40000036,40000037,40000038,40000039,40000040,40000041,40000043,40000044,40000048,40000049,40000060,40000061],..."binded_app" : [],..."category_list_new_user" : ...{...."..." : {"rank": 1, "name":"...", "logo":"youxi3.png", "logo64x64":"youxi3_64.png", "logo72x72":"youxi3_72.png", "slogo":"", "id":"41000004", "page":0, "type":0},...."..." : {"rank": 2, "name":"...", "logo":"shipin.png", "logo64x64":"shipin_64.png", "logo72x72":"shipin_72.png", "slogo":"", "id":"41000003", "page":0, "type":0}, ...."..." : {"rank": 3, "name":"...", "logo":"listenMusic_48.png", "logo64x64":"listenMusic_64.png", "logo72x72":"listenMusic_72.png", "slogo":"", "id":"41000016", "page":0, "type":0},........"...." : {"rank": 4, "n

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\addapp.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):682
                                                                                                                                                                                      Entropy (8bit):4.909863438974874
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:7WWZowjIzisjIXyjIirbHToONjoOiONsW6Yo6suXmMjIQ60TO7KwhoA+EoMOb:7WSj6isjRjTrbzoONjoFPlYoHDMjpFx5
                                                                                                                                                                                      MD5:8BFE9D0B36CB07F1EFD8EF5447120ED5
                                                                                                                                                                                      SHA1:304077E511928CC7F35D9B20E5C76F4FDDBFF64E
                                                                                                                                                                                      SHA-256:BB8611D4C1CDD69DD0024768A782D4FAF9D40357EBF5415B4D92F7676EF8CABD
                                                                                                                                                                                      SHA-512:501B6B3B7502F7FB47B7649580F313D20E4D0C1D1E38701E2CB16C0059C0C595820D95FD7C46DFE79F1C424E7614CCD3599BE9FE0478F96B3755A5E448897305
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<script>...function Addto360Desktop()...{....var title = window.external.menuArguments.document.title;........var url = window.external.menuArguments.document.URL;....var parent = window.external.menuArguments.window.parent;....while (parent != null)....{.....try.....{......var uu = parent.document.URL;......if (uu == url)......{.......break;......}........parent = parent.parent;......url = uu;.......}.....catch (err).....{......break;.....}....}......if (url == null)....{.....url = window.external.menuArguments.location;.......}......var obj = new ActiveXObject("DesktopMeunObject.DesktopMeunObject");....obj.Addto360Desktop(title, url);...}.....Addto360Desktop();..</script>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\bg.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 682x370, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):34299
                                                                                                                                                                                      Entropy (8bit):7.886401642174046
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:49GOMIVwO5aeCKHpstGctFhM0IkE3ountxkOu3miS+PE2FA0ETeBm:4kIVNMoHpsgc7esS1noOuWi9E2K0Ef
                                                                                                                                                                                      MD5:B550092E07391F8185F571A9FA468123
                                                                                                                                                                                      SHA1:E46E480DBD44D633D9F3208D2082EF5996102B98
                                                                                                                                                                                      SHA-256:BC079E3B3307D409A37B511DB9DDA0BC7C37847A4D1D370B33B7926068D2EE19
                                                                                                                                                                                      SHA-512:375640C3656B7FCD1225DD5D15415642D1541B136A9190B83B32D8542B942BB0083AFDEB8A11AFD4DF81FEE09821990976866B17B2658DFCDE3B121D2C027536
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`.....XExif..MM.*.......1.........>Q...........Q...........Q...............Adobe ImageReady.....C....................................................................C.......................................................................r...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....p..-....R..P...as.......)..iw....)3.z...Aa@.T.J.b......Q.H.....R...{.......ri. w....o.._.c....@..U....2*;K...J.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):979
                                                                                                                                                                                      Entropy (8bit):5.7907576185488425
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgwuHeWtzqlWTmkXE0BIVhs2oYJu81aWL82oyEbcISVOqJmrKkNR8VDmMWPGb:hP9uEleZEWEHu81aWwL89iRmDmMf
                                                                                                                                                                                      MD5:6390080D1A23C8A6CB2EA0B71E5B3C60
                                                                                                                                                                                      SHA1:4D4ADBC2063465785FC2595A077D9AA9DD986952
                                                                                                                                                                                      SHA-256:479E6A5D65021B734042BB1917E52660980841A92CAFD212BA263415B0DE663D
                                                                                                                                                                                      SHA-512:55F5A1DB631CC1E341660E37B99865B7D46E816B708D39EA957E531DD58D7CE00254FE2751452864720393F245D88BB287C9ABC3076539E74D6ED7B1266DE095
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gb2312" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<title>........</title>..<style type="text/css">..@charset "gb2312";..body,p,div{margin:0;padding:0;border:0;outline:0;font-size:100%;vertical-align:baseline;} body,div,span{font:16px/1.4 tahoma,"......",Microsoft YaHei;} ...wraper{ width:770px; height:400px; position:relative; background:#fff url(bg.jpg) center 50px no-repeat; margin:0 auto; }...wraper span{ width:220px; position:absolute; top:234px; left:123px; }....</style>..</head>..<body>..<div class="wraper">...<span>...............................<a href="#" onclick="window.external.wappGoCurrentAppPath();">..........</a></span>..</div> wraper end-->....<script type="text/javascript">..document.write('<div style="height:0;overflow:hidden;"><img src="http://monitoring.openapi.360.cn/desktop/nopen/id/'+window.external.wappGetAppId()+'" /></div>');..</script>..</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\img\body.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2012:12:07 10:58:08], baseline, precision 8, 1300x900, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):38959
                                                                                                                                                                                      Entropy (8bit):5.853823250628968
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:XjgIrjnsIrjn3U5TtE62Eop6tToxVWB0MPrEW2sfjPqxIbIrvBU:XjgIr7sIr73wtE62p6oFMDEW2szbcvK
                                                                                                                                                                                      MD5:D09B2C3955C3CADBC31B1E4A6523C188
                                                                                                                                                                                      SHA1:BF142841A6E5B45943D1C74431A349988D8858BC
                                                                                                                                                                                      SHA-256:4F4C74A700CBAAB12B3664F3824E5B681F7929E4DAC2714F497D6C318A309D9B
                                                                                                                                                                                      SHA-512:56C5474513B05F73AE514BAAC38EAF02A8ED94C406EF4E0A5B036E36080D210CF94C44076F35A235D71E77CBC9C11F900CFF71E31DA805CA2B4C5F435BB397DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS2 Windows.2012:12:07 10:58:08.................................................................................&...(.......................................H.......H.............JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................o...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..RI%..$.IJI$.$.BxN..j......Q...&...C.1j6...+.....THF..$.&Ej.I$...I%?...RI%..$..&~I)p....h..........D..&.V.E".....HV....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\img\loading.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 420 x 18, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1909
                                                                                                                                                                                      Entropy (8bit):7.234982063350527
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:PCCRgnxwhC+1SOLzA5+MTFC+M/BA6AlIxrYzI:KoyS8Og5rTA+BlCrYU
                                                                                                                                                                                      MD5:9DA3F1D059FECE8DDB1F6EDF43AC2363
                                                                                                                                                                                      SHA1:DB62DC742686C128F461938287DA27E4C522B1BF
                                                                                                                                                                                      SHA-256:E923BC0678176F9847AAFF4AC59E9F7C39780469BA29F6BAA481BA99312EF7AC
                                                                                                                                                                                      SHA-512:AA0DD1E1677D37386FD998676747D445D62DA8DF8A05B01A62FA5FE8D895EB428C473499C043957497AE7CAB63D6524A93B18ABDB900813355DD13D484BFC6F2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............#vZ.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEp.....t..............l..|..c..L..Z.....R..E..J..z..i..G..r..`....Q...S..Y..V..O..T..d.....M....ou.._..f..a.....G..{..{.....b........L..H..b..R..M..N..W..S..p..Z..l..t.......aZ..a..Q.....X..N..M....#M..s....mk..Y..i.....a..Y.......iZ..k.....r..R..V..s..s..o..Y..s..j.....s..z..S..c....t..X...H.......YS..F..^..I.....S..c..P..T..H..[.....w..R..P..L.....|..K..H..K..M..M..Z....hN.....l..]..R.....Z..R..S..S.....L..../Z..m..r..s..I....qL..N..a..Y....6R..r..Z....+{.....W..j....{O..l..^..`..|..g..M..j....JK.....W..v..t..d..O..J.......E...)i.h.._..L..p..J.....t..$j.`..b..f..L..^..e.v..6-p.[..a..:w.F.4a..,r.'n...26}.>.m$k......g~..]..6|.@.o..QR.3j..J....Zd..U.1%l.e..k....*2u.F..x..-s.M..G.%.....(...3.lc..'o......=..T..x..3t...t_.....|:F.....tRNS..................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\intalltempapp.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):519
                                                                                                                                                                                      Entropy (8bit):5.160278137718593
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgGxC7/mjWsVnqJmxTTqK5eQE8OYMCcfxqc2OAqUKCGb:hPrC1sV8IfvEYMCo9z
                                                                                                                                                                                      MD5:B00593D03F76B157C02A72A9F132405A
                                                                                                                                                                                      SHA1:FCE91F62543C4104BB906F3A83F6DEB7DEC0F5BB
                                                                                                                                                                                      SHA-256:825D1318B7463FD5F670958C5E7BEC7D609340661EAD84ABB4F2E68FF987498B
                                                                                                                                                                                      SHA-512:A33793891F05D7610FAD9D5B6F1EBCB4799871BE6F00C964E1390F36421085DC04DD1AE2C7BBB219FABBAB2FA94EAB2E923B491C81871A06EEA33EB639CBF2C7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..function changeProgress(value){...$(".in").css("width",value+"%");...$(".percent").html(value+"%");..}..</script>..</head>....<body>....<div class="box">...<div class="loading"><div class="in" style="width:0%;"></div></div>...<p class="percent">0%</p>..</div>....</body>..</html>

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\apppages\style.css

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1657
                                                                                                                                                                                      Entropy (8bit):5.247663084618733
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZICveGXqPF+9jJ1exEU+vZYNo+g8HVACmFnRlxnMXUbF:WJ1h+/RV++MZMrA9lxnMXaF
                                                                                                                                                                                      MD5:7E0FB59D3AF2D442F44A939362311DD0
                                                                                                                                                                                      SHA1:3F1FD2C2B9DDC773B6972F767BD321F353C6066F
                                                                                                                                                                                      SHA-256:DF9459349CCB55416078BA535A17AE8587BF321049F4D0A5AF460879B62B4699
                                                                                                                                                                                      SHA-512:03D0D5D69C38A7E1F75D39A31E9C597B862F9D1BEDFA14C4CB8FD37EFE5800FF01F97A917A8ABDE8C33E98A87436101D183250D101E5BB85B1686A1F3B3B7935
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...t-a-l{text-align:left;}...t-a-c{text-align:center;}...t-a-r{te

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\commonSoft.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with very long lines (485), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                      Entropy (8bit):3.4052657356597207
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:BkUTjUR538kywsjhTmdrA+GkdigZRuSziOVUyG6c:BkUsrevwhS6ZRpijyG6c
                                                                                                                                                                                      MD5:196D6C9F75C489FC82425F005433FD37
                                                                                                                                                                                      SHA1:2A1BDFCDF6EA782DBFF8E9A6BACF607F4938289D
                                                                                                                                                                                      SHA-256:B0F01FFE7C8CA5939EA630BF6DDEA9FF5F2612CB4F70C2886203BD05A7330761
                                                                                                                                                                                      SHA-512:244EB657BC3B14FEFD403EB487FA239B5899BEC542EAB86342C123018F6806249FD98208C578D5F7D48768465AF453EB00686FCDA0182AA5181C5F973BAD3B2C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[comomSoft]..id=103352,72,23,105037,4150553,105192,352,105245,64,25,19,105196,14,10105,104309,24,105368,16,4150375,4150365,4150370,103343,285,104496,100101667,4150722,105120,57,4150582,100114167,39,104701,10162,2,10099,103112,4150377,4150366,4150371,101536,100101099,100102281,4150374,4150367,4150372,27,4150149,85,75,102112509,10147,105201,10195,50,103937,101670,100101123,22,4150115,94,103214,7,4150162,100100487,10189,105449,59,67,10075,10082,61,104732,100101158,102783,104916,4150138,102749,335

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\deskrule.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                      Entropy (8bit):5.272552290119577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHd4QvGlZ5HrgEs8b9aF8+2H7/aRSXgUrVZlFOBL7z/Tcg9rLj/Z5ZLB3cVQhbu:JdbIZ5T6F8+UuSXRQ0g9fjx5ZJDhB9pw
                                                                                                                                                                                      MD5:084EB2021390A46882696EDF4BC48C90
                                                                                                                                                                                      SHA1:7496D514A4AAE9051DD6BE9687B52561D3C05577
                                                                                                                                                                                      SHA-256:BE94CD0BCA180AAAEBF8E698CB9638C23936A322F42BE232F1BBFFE343EC88CE
                                                                                                                                                                                      SHA-512:322D9F5F172D9888C934FC6B14F774D9B568E0205A0D9F249A761263AF5CF1850328855FA6AFD2BD02D9C5F2FD9E973D205F8D41DEB6FA8C32056D6B2D3813AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<Desk>.. <Category id="20" rank="1" name="..." description="" rule=""/>.. <Category id="2" rank="2" name="...." description="" rule=".txt|.doc|.docx|.docm|.dotx|.dotm|.dot|.rtf|.xlsx|.xls|.csv|.xlsm|.xlsb|.ppt|.pptx|.pptm|.potx|.pot|.potm"/>.. <Category id="21" rank="4" name=".." description="" rule=".bmp|.gif|.jpg|.jpeg|.png|.psd|.cdr|.ico|.tif|.tiff|.tga|.raw"/>.. <Category id="22" rank="5" name="...." description="" rule=".rar|.zip|.jar|.iso|.cab|.lha|.bh|.tar|.lzh|.7z"/>.. <Category id="23" rank="6" name="...." description="" rule=".asf|.wm|.wmp|.wmv|.wma|.ram|.rm|.rmvb|.rpm|.scm|.dat|.evo|.mov|.qt|.aif|.aifc|.aiff|.3g2|.3gp|.3gp2|.3gpp|.amr|.avi|.amv|.csf|.ivf|.mpeg|.mpg|.mts|.mkv|.swf|.flv|.mp3|.mid|.mov|.mp4"/>.. <Category id="7" rank="7" name="EXE.." description="" rule=".exe"/>.. <Category id="50" rank="9" name="...." description="" rule=""/>.. <Category id="1" rank="10" name=".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\desktoptool.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):815976
                                                                                                                                                                                      Entropy (8bit):6.583545883404885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:CHdnaQERSfWMwBsidpIitSeVkud0KWrQF8:QZXPudnWkF8
                                                                                                                                                                                      MD5:5CFAE5D76DED38E1CB816B78D8E66D2C
                                                                                                                                                                                      SHA1:924700D0891FCCA309EF6FBDA1877A82073FC68B
                                                                                                                                                                                      SHA-256:B7F777BF003E3EEFFC846E483FAA6C435AD1266560BEAC4D51A95703AC12D701
                                                                                                                                                                                      SHA-512:DDC75AEA59D9500E7BA8A4E592412752946935B518C90C3D2237422E12AF5790448918C6C938764EDAC39C98A65FD80C6DA7E8C2B4CD8047EB26B775F1476DFB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..eR..eR..eR.U*...eR......eR..7...eR.....eR.....FeR..?..eR..)..eR..eS.`dR.....eR..7...eR......eR.Rich.eR.........................PE..L....x.P.....................H......m>.......0....@.......................................@..................................l..,.... ...............`..h....@..ln...6..................................@............0...............................text...P........................... ..`.rdata...Z...0...\..................@..@.data............:...t..............@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtappcore.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):331440
                                                                                                                                                                                      Entropy (8bit):6.5814193529642795
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:kzs3sd6FY2zMINPNwB7Ki21uEodEsi9x2lEcJAxcvyXAO8+/ylz:Ks3sdsY2PiBFxREsi9x27Wucy
                                                                                                                                                                                      MD5:E2FB918E63CF2E8629227FD873A5A362
                                                                                                                                                                                      SHA1:8CB0D496D8A7FE7359537B6B33FBE521A1DCA32A
                                                                                                                                                                                      SHA-256:44C708835AE7F657AB5C07A465ED9375C810D907D1A17A5C33B31C2482515080
                                                                                                                                                                                      SHA-512:CA91972D7ECD199F23304581D190F86AE9D0196BF7C7307C9F9E4AC84F9BD8D0C13D4BD4E5A1D3DB00F1837B468837789902620C974704B6C07866C23FE7A79D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bk...8...8...8.8...8A..8...8...8...8...8`..8...8...8.8a8...8.8w8...8...8...8...8...8...8...8.8...8...8...8Rich...8........PE..L...qk.Q...........!.........X.......".......................................@......F.....@......................... ...y.......................................-...................................V..@............................................text............................... ..`.rdata..............................@..@.data...<>..........................@....rsrc...............................@..@.reloc...F.......H..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtfilm.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):799920
                                                                                                                                                                                      Entropy (8bit):6.4627860261767065
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:4jM/yrSizUTnIzVWz7PWY9F9Y8yVrpfiFRJyNLcE:AliXJycE
                                                                                                                                                                                      MD5:BE550CCD74044C170270D76FB2B38D2F
                                                                                                                                                                                      SHA1:A87F969DD5F4744323CC3C7B49231E2117CABF7F
                                                                                                                                                                                      SHA-256:1AAC90BF0D24CD4B164BCFFA338B4CFF3102C12769FD0A0777F2B964CFDDC8BA
                                                                                                                                                                                      SHA-512:32C82C00F2097CBC42AB0308B7F35096C99014E9E93710B0FC027CEC0272B086AC745F31CF01490AA6117D4C6A2B215E01B67A942259CA49719A3097AB70854E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`..i.F.i.F.i.Fh&.F.i.F...F.i.F.;.F.i.F...F.i.F...Foi.F.cF.i.F.uF.i.F.i.F.h.F...F.i.F.;.F.i.F...F.i.FRich.i.F........PE..L....ZQ..................................... ....@.......................................@.............................................D......................(....'..............................h...@............ ...............................text............................... ..`.rdata....... ......................@..@.data............V..................@....rsrc....D.......F..................@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtswitcher.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):146792
                                                                                                                                                                                      Entropy (8bit):6.652917793404133
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:c8D6ap8rG5eDM8iTbcGiTKiSOufcReWTBf+r5wHvOc:c8ppeG5eP6itSaeWTB3POc
                                                                                                                                                                                      MD5:A0778C2A0DCFF99F83CB63DB2537C0D6
                                                                                                                                                                                      SHA1:253F2B000F046C62D77B48A87A4A99819D647996
                                                                                                                                                                                      SHA-256:5C5BC028291B1940D03036F0D125EDB17BD2E6D3BE66900A16CD98B739507F2C
                                                                                                                                                                                      SHA-512:84B058608B781B3383CCEB9A3FF26602E631CC398FD57C310EF785573F1FF6DA23070957D4554F6FA8526ABC6A6141432E154F186A4AF4D926C36BC5B414F8E6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S)V..H8..H8..H8......H8..0...H8..0..H8..0.. H8.0.U..H8.0.C..H8..H9..H8..0...H8..0...H8......H8..0...H8.Rich.H8.........PE..L......Q...........!.....d................................................................@..........................................@...............*..h....P..\.......................................@...............0............................text....b.......d.................. ..`.rdata...x.......z...h..............@..@.data....>..........................@....rsrc........@......................@..@.reloc...)...P...*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtswitcher64.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):167544
                                                                                                                                                                                      Entropy (8bit):6.3438521480270085
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:QAI9+Gkf+xVpBHO9mNMy4ZFMV2bWqtsRi2TBf7sWr5qJcR2:zI9+GPJNMy4Pw2b+i2TBwWcW2
                                                                                                                                                                                      MD5:F54B6E8B821138CE6110DE7B964E53D8
                                                                                                                                                                                      SHA1:0EEFD010E4C9001B795B8A81FF2B8BDEB854A219
                                                                                                                                                                                      SHA-256:DD983F896F412B264B9D0E2B296C63FFD750B81E1240794B312C967752D89DC0
                                                                                                                                                                                      SHA-512:AC5BD4F315F3FDA20EAA0CAFC371491D936E1389C517B093CD561888FDBB96457A8F1848047F519419B86495BA890C394873CE998E6F5BCBDD746A533BA92C44
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........jR.............3.......................................3i......3..........y...................................Rich............PE..d...h..Q.........." ................................................................(.....@..........................................P......x;.......................z..x.......|.......................................................p............................text.............................. ..`.rdata..............................@..@.data...PK...`.......:..............@....pdata...............V..............@..@.rsrc................n..............@..@.reloc..F............t..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtwebbrowser.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):760168
                                                                                                                                                                                      Entropy (8bit):6.41146860850765
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:QZKD6SfHPAf/Xjd8xob+5kcc4cfpcJIU1GhDan4Jz/izR36nYNTYhrW6ZLsvMq:QZQkKxob1cG3U8hDa4JCR3YYNTYhy6m7
                                                                                                                                                                                      MD5:26464985B396AE1DB6A2D6E7B070A3C8
                                                                                                                                                                                      SHA1:D102D7817311F1999D0251A80DFEAC2895E8B0C1
                                                                                                                                                                                      SHA-256:93AEF6CA6FA760D3783EE1157B3E9EAE1F6EE21C3D1BE39D4485DE6DA70F21E7
                                                                                                                                                                                      SHA-512:FA2E8D7B352F05C696916FCF762A47BEFE119FD51148DC525F2AB569E98FC94E97EC1369E4ABDF07151069464DC9839E61C063C0336E6EA16A18F72F7EDDB5B7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1y..P.Z.P.Z.P.Z...Z.P.Z.(.Z.P.Z...Z.P.Z.(.Z.P.Z.(.Z.P.Z..zZ.P.Z..lZ.P.Z.P.Z.Q.Z.(.Z.P.Z...Z.P.Z.(.Z.P.ZRich.P.Z................PE..L......P.................L...6......it.......`....@.................................R8....@.............................................................h....P...w..@g..................................@............`...............................text...kJ.......L.................. ..`.rdata...{...`...|...P..............@..@.data............H..................@....rsrc...............................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\dtwebframe.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):171480
                                                                                                                                                                                      Entropy (8bit):6.44138290249757
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:F4qo0pTzJR9UoHQfxhKQ2ulRCW/ZfGEAkz5GRWGgTo:uYT1X00Q2ulRCWBfVY3gTo
                                                                                                                                                                                      MD5:755FE45383AAA53782A41CA691F700F1
                                                                                                                                                                                      SHA1:405182FD8BD46541018002749DB2185364A2FD2C
                                                                                                                                                                                      SHA-256:1BCA911A9D638D11634F4B1D27AED484163355ABA41E78312EE9DBDB7F062CA7
                                                                                                                                                                                      SHA-512:BAE5191CF2544F8F107944483EA8298A5319E37779A162423A837F1B8E6C203CDD0692AFB9077A895C3BC16F1951C50263164A041EF3CAE69D95E00C978C3E91
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...up..up..up...?..tp..|...dp..|....p..|...Op..R...qp..R...dp..up...p..|...|p..|...tp..k"..tp..|...tp..Richup..........................PE..L.....[Q...........!................"...............................................R.....@.........................`4..~...\$.......................z...#......` ..`...............................0...@............................................text.............................. ..`.rdata...t.......v..................@..@.data...XA...@...$... ..............@....rsrc................D..............@..@.reloc.../.......0...J..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\feedback.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):101756
                                                                                                                                                                                      Entropy (8bit):7.984229877137076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:pwZSCv8gKAqBR/vJALWyQcyNn+dzE5a8jceekR/XFhO08+gPw4Yl:fCvxrWEC7NjcMXbXqPw4Yl
                                                                                                                                                                                      MD5:51C69416032AD295317B21223281BF4E
                                                                                                                                                                                      SHA1:11317DAFEA5B4C1B23B18833CDE918EF6122E912
                                                                                                                                                                                      SHA-256:F504B235B63200F5A9631E74BAF762598B43BD6495C0B9A396F1A06DF56AD1E9
                                                                                                                                                                                      SHA-512:A4900D4B21B99D447C5DB67320C27C240B52AC76D7105D447C40FA103F82DD86589BDCAF2A6560AD04CC63BE66C8FD6D7CC90C9F8194726032E9FD8F92E88F46
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........JA................feedback/PK........6}n?..Z............feedback/FirstPage_1.png.PNG........IHDR...6...6......Ej.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B82911B40E8411E1A1B9AA370C350279" xmpMM:DocumentID="xmp.did:B82911B50E8411E1A1B9AA370C350279"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B82911B20E8411E1A1B9AA370C350279" stRef:documentID="xmp.did:B82911B30E8411E1A1B9AA370C350279"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S....IDATx..Z[l.W...W...

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\flashApp.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):385200
                                                                                                                                                                                      Entropy (8bit):7.182105590695188
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:MEvvCXZPBZirt5lLK8WqZaWZYlY2hE8XqYR/pURWepSmEU:M6CXdBZirtvxDZNYl44q+paWOSm
                                                                                                                                                                                      MD5:28580334E670277D005E38D4C9E65CFD
                                                                                                                                                                                      SHA1:7EBAF822980EE5DB3A7ADC20C5F266704433210C
                                                                                                                                                                                      SHA-256:E4A42DD9B58F3D7B0A8493B837769C5D32DBF5EDE29A805E3808D4530E410E45
                                                                                                                                                                                      SHA-512:1EF9C47842477F3F7553C5B9CAA30ACC2D1DCA73F3DF86F2E608DA9027B44AAE5B338DF389A7E050B2DF53CF8D20724596411392307F856D6E9CDA90F4F82AB8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................M.).......*......;.......<.@....9.......9...............6.......;.....+.............Rich....................PE..L...3..Q.................*.........._:.......@....@..................................p....@.................................@........................................D..................................@............@...............................text....(.......*.................. ..`.rdata...y...@...z..................@..@.data...............................@....rsrc...............................@..@.reloc..6l.......n...X..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\360GameBox.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1143104
                                                                                                                                                                                      Entropy (8bit):6.908541805805633
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:M7rMZ9VnpbFmR3Wjih7gK3FNhAuqtqo40gu9xZu9xZoPyL7:8rm9VnphmQihVhAuYqo0u9Xu9XNL7
                                                                                                                                                                                      MD5:8DD4CE4D5EEE031135A64117731F0187
                                                                                                                                                                                      SHA1:139CB0851FDFEF952BC80307F22B9132B941F64E
                                                                                                                                                                                      SHA-256:428A0546DCF68A9ACB6A2CDC6082168652E3D315493230D06C80102BD3D09B1E
                                                                                                                                                                                      SHA-512:1930E581329EEC9B64AE1949AE84563E3F247C7AFF5622ADDB289D1630FB3364BF295CD1D610207D6B5BBB5FCEEC951614AEC9CA8DA4687333BA706D96D9E757
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..6...e...e...e...e...e...e...e...eM..e!X.e...e!X.e...e...e...e...eP..e...e...e...e...eRich...e................PE..L.....Q.....................t....................@.................................e.....@....................................,....P...............R..@....0..........................................@...............(............................text...:........................... ..`.rdata..P...........................@..@.data............<..................@....rsrc........P......................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\360GbApp.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2015408
                                                                                                                                                                                      Entropy (8bit):6.301459019627537
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:fxHf82WTNblrzv1I3pF4HYvMFkzFqv+IFPpds07XTuG+W40oS7B7L9xZY00:fxE9I3H4YCdpz7DuGvoGB7L9XN0
                                                                                                                                                                                      MD5:F20C9B80E5D66E079E4350A1BA0F6295
                                                                                                                                                                                      SHA1:1379EE0823F1B3284611B20F079CC7679C5B4FCE
                                                                                                                                                                                      SHA-256:7764AABF7B2B1756980BEEB384A63106841188DC03A9EDDB79F8F2FE451B8757
                                                                                                                                                                                      SHA-512:8B8608B1B318CF63D86AD4CD66BEACE9A0F294E9F986694B9DEB8C7A3338EFA05F8A0714A9EF6CCAE1384DE0452B29C603421AC00ECB1A489D6EEFC0FB6077B8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V.........w.S......P......A......F.u....~.......~.............A.......O.N.....Q......T....Rich...................PE..L...v2vQ.................t..........R.............@.......................... .......5....@.....................................|....`..Dn..........................................................H#..@...............t............................text....r.......t.................. ..`.rdata...............x..............@..@.data...d........Z..................@....rsrc...Dn...`...p..................@..@.reloc..hK.......L...Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\AppcenterDataGb.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):642920
                                                                                                                                                                                      Entropy (8bit):6.282990832147541
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:5qBB65rJHvhc5gWES4bpbDBCWSul20XW6+MSP95HiVNT3yUO5VZPIxT2AdhWXhlG:7rYUbpnBCWSGP2AWXh5569l
                                                                                                                                                                                      MD5:C9DCDAE63FC4BC3BED7298E7C6FB3D15
                                                                                                                                                                                      SHA1:F573C038E3E005172F475FD4EE805060926BA3CD
                                                                                                                                                                                      SHA-256:468A1EB791002CFC420EBF42DF8D9F07DD345B630584D30A74305EA0F0F62329
                                                                                                                                                                                      SHA-512:2AC67254AFB1F12C8723FC031B95E73F8F07F15E2781CDFBDB03EB0C5D78CEEA47A52AD8864E3B7A488E96EC13B926F20265CB811F04F6F51A45E9E9A1E1A060
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..S..S..t...R..M.n.V...|.R..Z...I..Z.i....Z.n....t...\..S.....Z.`.~..Z.x.R..M.~.R..Z.{.R..RichS..................PE..L.....%Q...........!.....H...p..............`............................... ......-.....@.........................`........t..x.......................h.......tT...b......................H...........@............`..l............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...8U.......4...p..............@....tls....I...........................@....rsrc................B..............@..@.reloc..Ds.......t...H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GBACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GBDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GameBox.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156848
                                                                                                                                                                                      Entropy (8bit):6.538614114866669
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:2c7Qonv+JBCrms558lMUVnUWxYAJ/Rtrpt2sytOSigKPiSj2eMsRw8e6ciPyyp5B:2G8Crms/8FnPBT7gxShAmwA5cgTx+
                                                                                                                                                                                      MD5:46D0C5A9F1DFAFB0B842BCB2A944B1C5
                                                                                                                                                                                      SHA1:233B8E2769625DD09A576035189D4CA3327E02A6
                                                                                                                                                                                      SHA-256:BF84D8270CC9C4100D8DD52CFF5DEDD30CEDFF723BE38929FA32400BE5D97D8D
                                                                                                                                                                                      SHA-512:E5026A954F575D4FB24109CAC306AC1D848EA62B16475CDC450D3CEFB4B93E1BC45559E99059F927FC2ADBCE7F95EA11BE2A45A7CCA2894C5AA6310F7355D855
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.&...u...u...u.yVu...u.y@u,..u.yGu...u..u...u..u...u...up..u.yIu...u.yQu...u.SWu...u.yRu...uRich...u................PE..L.....RQ...........!................................................................x+....@.............................I............`...............J.......p..4...................................p...@...............,............................text............................... ..`.rdata..YF.......H..................@..@.data...H?... ......................@....rsrc........`......................@..@.reloc...&...p...(..."..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\gamebox\GameBoxCore.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1124528
                                                                                                                                                                                      Entropy (8bit):6.484809189310972
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:Dp6e4S9JuvOCZLmvTO33iFnzQkOMnNf1bt:8S2OOGOMNf1bt
                                                                                                                                                                                      MD5:5619853A5AC4F54323F54A949160EA52
                                                                                                                                                                                      SHA1:60D787F954C12A23AB17DDED9F91C6C4B0B22173
                                                                                                                                                                                      SHA-256:937EC6B0A8D5EFCA5E35F09A11BB6BDDA44FB4EFB9E0CBB9899BF67287820F3A
                                                                                                                                                                                      SHA-512:1607C6A9614F5D5809BBDBA801E9BD2111977AEAE2114B35FA3110E662ED158AA107D6B2732579F7F34D26424D9C52B3800F0A045787F84363B13C8787B6A876
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j...8?..j..e%-..j.......j....8.ej....?..j......j.......j...j..Ok....1..j....)..j...8/..j....*..j..Rich.j..........................PE..L...$PUQ...........!.....l...........................................................Y....@.............................t...4........p............................................................. e..@............................................text....j.......l.................. ..`.rdata...+.......,...p..............@..@.data...\........v..................@....rsrc........p......................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\img_reader.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):203608
                                                                                                                                                                                      Entropy (8bit):6.832543174324689
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:CxIYp86FpmNh/ZBypa4ZunTBfHFy6Ag0Fug795fz8:e86As2nTBvFy6AOIvo
                                                                                                                                                                                      MD5:D3A9CA700C1C65D6DF7E010B0CB0E3F4
                                                                                                                                                                                      SHA1:8E35CFC937B783808DA98376B5ED6163BD77148A
                                                                                                                                                                                      SHA-256:CC4D278AB85A0CEF68EF29FDBF723830C4F2BCC78B5B315F1530674059BCF0CE
                                                                                                                                                                                      SHA-512:8102BFEC316B89BF100350607491942332E881AA80981AEAEF8F607CAD5A4661B8E07BD9FE74506D8D775A56FACE181CF342074668338D42A3250A041AED4269
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...............u{...................uj.....um.0....u|......_z......u......Rich............PE..L....HdN...........!.................6....... ...............................P......x0..............................P...K.......<.... ..................X....0..........................................@............ ..,............................text............................... ..`.rdata....... ......................@..@.data....3..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\oauthlogin.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):343680
                                                                                                                                                                                      Entropy (8bit):6.438296507662578
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:Od5qu1VG/cPM45zTHtcpBBzCXkLDLdfewus5qdr2ZdS1ltQp6:Odgu1VG/cPM4uBzCXkPLkwuwiu6
                                                                                                                                                                                      MD5:A1ECB29EC8237F21ABD334830573EC34
                                                                                                                                                                                      SHA1:DAD2D8F5976A018F3A5FE95C7DA5D8744971D5F8
                                                                                                                                                                                      SHA-256:AB07B5413EB43D56151EA1B072945A3FC0C075BF108AE9977EDB46B7D102E9E9
                                                                                                                                                                                      SHA-512:EABF128304CAB9540556984C43EFCA678897CA9DA07D5949C698156A6C38E8A23D037E98B7138D1930C33403185BDAACC842C79EFBA20FBEBB1379C437A2DEEB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tF..'F..'F..'O.3'W..'O.%'+..'aV.'A..'aV.'I..'F..'...'O."'|..'X.2'G..'O.7'G..'RichF..'................PE..L....NuP.....................t....................@..........................`.......>....@................................. m...........\...........(.......0...+...................................<..@...............|............................text...Q........................... ..`.rdata..J...........................@..@.data....E.......(...t..............@....rsrc....\.......^..................@..@.reloc..B,...0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\processinfo.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):122768
                                                                                                                                                                                      Entropy (8bit):4.236342363215504
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:z9Dkb269rP3V7uSYlEPxFPyELzsyvzj/cA8RHBBLjOmHLU444XKY:xm99sjEPxdRsyvzj/clHDLjOEH
                                                                                                                                                                                      MD5:24AC90D7EAD74E0209E34980ACD6293D
                                                                                                                                                                                      SHA1:977282D32694522AA33ADE0BFB83125146F009D4
                                                                                                                                                                                      SHA-256:C01353D25AFC374F4D9F1778275E1567B3BF788E8470A2A418967CA1D160B04F
                                                                                                                                                                                      SHA-512:A13396D8EFF3C5424931CB89D70C0EE277A08553737BDFA0A4E84BA37EE2C3E9846A464EC6A4B6B206B74353742ACEFECEDCEF5DAE15D1DFD050179FCCC8A2B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:0.......`...827eb51d10dc0e456e68db11d0431dc8....lm............................................................................................................................................................................................................................L....K.H........................................................................................................................................;.-.................................................................................................;.-.....K..................................................................................................................................................;.-...-.....;.......V...o......................................................................................;.-...-.....;.......V...o...........................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):107826
                                                                                                                                                                                      Entropy (8bit):7.792287703743184
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:4HHVe8m7Gl8uCfXifiCb9ODesEbX1k2DKe9HtgjOQWYTYm/be5kpJe34S:4nc97eCifIugez0oA0mex
                                                                                                                                                                                      MD5:62A7CFECA9E143685F94CFC2E71A921A
                                                                                                                                                                                      SHA1:205E2C1B99F3E447204F08646E798ED050B957EC
                                                                                                                                                                                      SHA-256:D3D1D61B0BEFB079634B835FA3F1C9EB8F059E75B8EC68958726FD511DA7E8F0
                                                                                                                                                                                      SHA-512:4B1AD1B64A1008CB3570426DE02E8F603244DF34456B22A76E16B7362D7326EE4AC846A0C96E166E8A85B41216B7410851E84A2F4985C79FC84B2FE43948D1A3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........a..A................Main/PK...........A.v.OD...D.......Main/Apploading_Back.png.PNG........IHDR...u...\.....gy.p....PLTE...(((999)))OOO...jjj.........]]]???......'''......888QQQ...jjjMMM...............???......&&&ttt***ooozzz......KKK.........^^^...&&&999bbb..................^^^kkk[[[......LLLttt......~~~...|||[[[zzz:::..................???......ooo...bbb.................................nnn\\\mmm...|||...,,,..................\\\aaa{{{...........................]]].........lll..............................ddd.................................................../....tRNS...............................................x..v............................P.V.ac.;.9.....................?.=.......t............i.}$....IDATx....s.@..p...{.....Lz.=..&.'* ...>......./.....?.a.O.#]Hlb.../D;n....1.1ueK.+[+.j..f_....a.....m..l.....>.f.6..EPw..EP...EP..Z1.U.r..\.*W..U.r..\.*W..U.r..\.*W..U...J......$...yrx;I.WI/z...'..N.W..uU.qi.KP..\].. 3W...`(..B.....^.I...T.......T:].\x*.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\BoxUI.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):61433
                                                                                                                                                                                      Entropy (8bit):7.869530410617645
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:Dx9SGDcO0/B/P2+GbpC6RC8njzkMJrfFeL:DxodO0p/PhGbE6g8pFU
                                                                                                                                                                                      MD5:A0ECA7EF00B438895278B9D40F8DB5BF
                                                                                                                                                                                      SHA1:6CA54033BBFAA838449E00F2765298D4254960D8
                                                                                                                                                                                      SHA-256:5910798D0FBC1E84A0C8AF4B55390B402406D15D4344AD0D8F8E3DFD038749FD
                                                                                                                                                                                      SHA-512:55CE6DD0504622F940E006BEF8BF8ED36FFE02034DEB222A24FDD57F44AD454D1B0AC5E0B65A2BDB6DE66C9C40BD274F5C8579243BD81A58D2AE43C6A3D65AA5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................common/PK........g..A.F>.7...7.......common/head_ico.png.PNG........IHDR...M...%.......Ku....PLTE...........................................................t....<....h..ef.u.....f.<6!..C...k...vn.s...............Q........M...3.F]..,.m.{?#\Rh..VU..v...<J..?.T.r.u.Z..QQ:..HF>..#.8.....u.ayv..c1..\...~...H%.7..f<.0&..A.C,.T.................`........... ....f]....].)w...Q....E3.......M......-^..........'..{.`..0%..O\.........J...f.......n#....a........A.o8....G.s.....w...........[.0w.$m..V..H.:s.....<........._...........~.p....a............u.S.........o..O.........................r....P...............................................W.......x...........................\....xy.H|..........e.....p................^...........P."..........h.k..z..........{........!........T..o..M..........}....................y.................[\}....tRNS....:pZ.L.8.U.Nafv...#(0*....IDATx..y\.g..pw.j....?~{o...z.j.....U.E..*XE....B9.r....\R....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1811373
                                                                                                                                                                                      Entropy (8bit):7.714585163627127
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:jdcOGYopXd6G4xj84yv1MChPCPbxK52v7ZB3K9bfxIDJ5EM6F:jebYopXkG4N84QfQI5U7rAbf2jEhF
                                                                                                                                                                                      MD5:9FB74481FD436C7FD89E16422C0C12C0
                                                                                                                                                                                      SHA1:98C10F142ABF7037270DA2CB00126144C49386C9
                                                                                                                                                                                      SHA-256:7F9F650EFEEA922014622E35DE56A2B2662047A712CC3E84FF90ECB3F3CB1FE9
                                                                                                                                                                                      SHA-512:6054CCCC0CBAC05546A1DECC4EEA242C33C4E32B4993F061100AB5D99EBD8A23438BE63E7FFEBA42BB0C45AF376B2A5DF8E469F0F54AB41C7A8CB2B67D59D1E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........r.B................360Desktop/PK.........r.B................360Desktop/Image/PK.........r.B................360Desktop/Image/DesktopLogin/PK........k.vA...j^...^.......360Desktop/Image/DesktopLogin/DesktopLogin.png.PNG........IHDR...?.........M.%Q....sRGB.........gAMA......a.....pHYs..........o.d....IDATXG..[..P......|..Y.." .G.D ...Pn.N./.....e...[w/...m..n..I.E7.}..<.E7...I..A.0.r.q...{....m..E7....i...z].r..n..*....^..\t..EQ......e.\t#.ss..E7.,.4}.E7^...D....O}.....{Z....I..."...-I...r.(N..|..n...y....E&...n.~~.....c....k. ..T.j....IEND.B`.PK........k.vA....f...f...-...360Desktop/Image/DesktopLogin/DlgLogoutBK.bmpBMf.......6...(...[...............0........................................................... @.. `.. ... ... ... ...@...@ ..@@..@`..@...@...@...@...`...` ..`@..``..`...`...`...`........ ...@...`....................... ...@...`....................... ...@...`....................... ...@...`................@...@. .@.@.@.`.@...@...@...@...@ ..@ .@

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\ExtDefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2336806
                                                                                                                                                                                      Entropy (8bit):7.681664651191492
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:4/sKminYwhNLEdYxJTGL99wCKXa/5DKifqxfNbubg:4Hm4JTA9OXgDKifA
                                                                                                                                                                                      MD5:33482017DE37B560E2E082BAFA64BD43
                                                                                                                                                                                      SHA1:3A0174E999E7F3DDF7B93A58C8856D0FA4C22960
                                                                                                                                                                                      SHA-256:9D1593DD743880A7A2E85E3AC3D06DFB3228029C8B95E6E3E4F19DFC43998C08
                                                                                                                                                                                      SHA-512:60CFF2EC8A18A5810B6C4DDDEB3BC170A0D034BAFCDB4A3B98981EF59AABB25703F5A9662E80CF41485D29ACC86BA818073F9B7D9A2183406A42BFA2E8E4E5EA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........^|B................360Desktop/PK.........^|B................360Desktop/Image/PK.........^|B................360Desktop/Image/AppCenter/PK........;t.A....P...P...'...360Desktop/Image/AppCenter/app_logo.png.PNG........IHDR.............(-.S....gAMA......a.....PLTE......................%......R).U+.I%.1../.... .....".....9....@..!.FG.Kz.u"....Y. ..$Xr!...yA..@........,.o$d.,...b.).5iu&g.)..".<..z'.&a.*uj%....w...............|. Wh#..".."i.'x............:.{.!......x. x..r..o.................._0.N(.X-.T+.R).....$........;....E#.G$.3..........y.#.>.r.)..#.? ..(..&.6...'..).4...&..0..Q.....e..Z..*.!...X..@..'..&.$..$..#..? ..*..)..O..@..%..C..=.....&..2..$.....(p.&.-.....5...'..... ....7....v....'..$.+......&~.!..$[..G...LtRNS...n.p...c...........~.q;.z..s...q.E..p......l...=.|m.EP...2Q.....Ho......3....IDAT..c.F..`..s....\@.j&...@..RfM...Sg......s.g....i......M.2.......(..,,-..U...o.l......UPT.T.*.m7..p.F.f.h....wL7....$eO+VV*.k.....W.L.J...kl.....M.....m.>..(

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\RSD.UIZ

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):80837
                                                                                                                                                                                      Entropy (8bit):6.8668211039666325
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:fEArBeaHAIb8V5M85UvaYNk8U5UKxwtsZ5jQee5V5zmXWc5kv5J:3N7bo6bUSKqmZQZHgmP
                                                                                                                                                                                      MD5:6F8BE453B7544FD464BA49305BAF6978
                                                                                                                                                                                      SHA1:122D2BEB15D74E31323B29E252BBEE58145A798D
                                                                                                                                                                                      SHA-256:0553DCA84E185E62CC743B97FE68F7A692382C82CDCFEEC2F7B4697FDED3B2F3
                                                                                                                                                                                      SHA-512:D5960470F3C65F536EE3FF9C78301F18B2B06677CA157B52C7F30C9DA42AEA2ACB8BD9841AFFF725B316CD676207358BFDA33D3BBF4E9EF457FE8399DD56543D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........@j..OK...K.......Accept.png.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.06/21/12Hd.2....tEXtXML:com.adobe.xmp.<?xpacket begin=" " id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:CreatorTool>Adobe Fireworks CS3</xap:CreatorTool>. <xap:CreateDate>2012-06-21T07:41:33Z</xap:CreateDate>. <xap:ModifyDate>2012-06-21T09:09:22Z</xap:ModifyDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Hibernate_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):395
                                                                                                                                                                                      Entropy (8bit):7.02648562161403
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YEA70T6XC28AtUpT8uzcAi+iKcRTg187nbaw6/:asNXC28AtQpGPnWf/
                                                                                                                                                                                      MD5:EA698EFFCC18B771E9FBF319303BCD4A
                                                                                                                                                                                      SHA1:95D85D8AD59E7A9C3563E84FE0B1422034E69B89
                                                                                                                                                                                      SHA-256:6B7A446C99D37B4660651988D57D93E1F7C6D66BA17A46A992FA9A5C162FCF4E
                                                                                                                                                                                      SHA-512:BDCF16DE383234D30A5141105487C6DFE2A6FCA89594072E40DC821A6DA05F226A6C89877D261A38ED35B3988DC1EB300A1BC7C8BCCF1854BF2C9D060828591D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<...-IDATx.b...?.`.L....Z......b-"........b.".:.. .#.4.......'%!3...kD.t.. ......\...M@.$....oILB.@.......C..)).S... .F.{..U@..DG...A .@.{...@|..\)..-h....ud8J....9.5..!;...I.q3..#.}..Z ~L....x7..".}.bW .NJ9&.MS"Hb.....H.2.4%.$...=.."..'..@.<5....?Z.1`K...cG.UI.I..RB..T..E.f....@Fr42.FG.....A.......Sx..P.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Requit_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):347
                                                                                                                                                                                      Entropy (8bit):7.019000990470969
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDspXA70R2g9ElGOk22HzKc6gmHmhhkPsMrhXjik4oIeVCp:6v/7YFA70ESOk22Tt1mGhhkP+JeVI
                                                                                                                                                                                      MD5:4349B07C5800C0E2B65481D93F4B653A
                                                                                                                                                                                      SHA1:804FAED1B3FB17E380EC78BD5FA062E98DE8DD13
                                                                                                                                                                                      SHA-256:49CAF62DED2D60FC7452A69E4FACE0A49B9A33725B4958259F3520D51475CE4D
                                                                                                                                                                                      SHA-512:BD5FFCEC5D691FE7B394A9C47214B837F2CC5D9CCCC3020150B04BA1D8296019E25DBAE396C55D651B4B8CC13F32A0658C5EF84C539322A64035899811DE40B4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. .;.X..3..q9..a .!.#@l..0..|.0l3.1....0.?...g....@.....k....jN/......./ .....9.I.../... .C(.....x..o...:...O..@......C.y/....A.P..7Rs%.\.:.8.i..8.M?.......X.Y....Q._#..c..&.....0..`m]..X....U.>.c.....)..K...:p.&.A......R.=b.,B.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_ScreenLock_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):359
                                                                                                                                                                                      Entropy (8bit):7.047104233126481
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7+4nDsxHGA70ZxGJjf2JQM0aoKkI6Nid/bGb8O+5HOzmpNscEljp:6v/7YpGA70axfBUfdSb8qQNscElN
                                                                                                                                                                                      MD5:C423A7B7D20FD83972A183D180B5041C
                                                                                                                                                                                      SHA1:769B4CBA8AAEF6E1945825B9C333C080F1FB87AE
                                                                                                                                                                                      SHA-256:688ED6240E1D15ABB3CD93AB6F272D906468748D531401DF8C773EEF88F334C1
                                                                                                                                                                                      SHA-512:D71F8807C2819B7921DE0E1BF81A07B40775B119F152B05AF8D2A0D95D80D784A3C5641D74C4F5A10C588494C4A24EA003C96131D1C15F79429D1E8595F2C6ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.`.L....Z.. ...8...H....'..Y4qO ...$......x;.......(d...=#.Q....@....P..$..k!.C....".A...c...kh.N ...C.Z_<!p.....m.e$%.k.)....+.B...!...L...?$..l......)'...B.I.-1!.Ea.$6}a.!5*}..BR...+..h......J.%.H.%P%1.I.X.............u,b)@..@-.....b..1b.@......].^.g....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\CloseMenu_Icon_Shutdown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):631
                                                                                                                                                                                      Entropy (8bit):7.626311021105664
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrrymkgsRxrqWqrBZBWQ/2VUs3LLna6IGak2HfRr2iPepdMF+a1I:5rP5WqNZBWQ/2VpLn3IG92HfRJP8dDai
                                                                                                                                                                                      MD5:87A70E9FF0D11BA48E5B7604DBF57015
                                                                                                                                                                                      SHA1:D665F4655DFA2C9E2ACF3E562E615706092DD473
                                                                                                                                                                                      SHA-256:DDA0338E3075659104F9DD9709D5886F66BA78EA776D132DCEDF1043A18077EA
                                                                                                                                                                                      SHA-512:73066FEF76221682A57CBA27DDBB0BA65728DEEDB79A6021101E6CCC3929FF7BC78B34A093A52AD58CB81F9D0F018FBB14087827669EC3322B901188D5882DD9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...MH.A...gU....>......Q.......D.=.B........A.B..|:...R].%.. H. .......n...y.......?....l..af;...6M.....-js..i..<.....8.?#.1G.N..:<;2.%...].2.}:v.WP.zKy#.q..)...'.C..V4...L...K.q.....\..O...%bDj.-\O.b..d.+pW.?Q..>9bg.....^../0.r.s......mG._..[Th..SyT.kG......;.U..#.Hl`.oe......K.. .4..c..{K.9..5X...b(...KA.H..5.+.<:{@..G..........c..w......8.*.[.&.BiJ.;....ll.....6`^.....U.."...FQ..@u~.6*..l..~.6T..c..2S.S..(..Y...u...L........s|\.n....(.y.......:.....".cY.Ef...ZX.'....pp.pCgp.b-...*n.c;....&..!....p.1....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\ColseMenu_Icon_RegularShutDown_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):749
                                                                                                                                                                                      Entropy (8bit):7.674442193551587
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7YrZyB7f98Au5mmssbvEkBBB4/ekhXEwcd0pQb8qLvIB7XHv0YVKz:5ZmWmZ6vEkl8eZw5fWI1HjVKz
                                                                                                                                                                                      MD5:ABFC420E928867010F81332199A9C750
                                                                                                                                                                                      SHA1:1C64A27936D6EB105C6CCD13BB52115CAC1E374A
                                                                                                                                                                                      SHA-256:B0B412938BE3C4D916FAE362B01DE3145924BCAD46941F9E8BF34530FC79E274
                                                                                                                                                                                      SHA-512:9E6958BCEC49950BD013C81CF4FD94485042301CF106303F3D3C9803F4BEDCDBCE304EDCBEF45DF864F53DBF7FA351AF883F07739A3EC9EC96E26C30512EEF6F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...KUQ...IA..P......{HD....?..A...pSn..6....B.H..."..j..-.".M.......#.]...'..9.y.....9s..=...I.}..r`.~.....$P.....:p.d...../.r.d.6..ri..f. x%/H..J.4..R...l.._.>GA?hJ.k......TR..[.`.$.g..*...^.....^r.~3.1...R&....-....J....0.7.w...O...-bh...d....<..c.Q2..f.B.hB$......xJ{.X;..m..<.WL[.l.^.lfU.PO....O.x.....|E.......]D..!.M....~.....o.L.8......f...^.........X....z...;.M..Z....g..|3.o...`.#. f..".U.rK.>......zM&......1.....9.wI..R7Yb.....@D.&d.S.?.....%....8.N.w..F...- .u.|.'A.}.l5.4.NG..,=L7...~G..,....#m.#)...e.IS`.|..)..F.$5.o.8...y.#...1..1h.W...A~..a....U..,.'.A.4.s...u.I2.5..t.....'..E~.!z..p.;.1*W=..x..c......,.i.P.F.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\Menu_ItemEx_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 38 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                      Entropy (8bit):6.728601858101068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhP7TpQHMkmnR4ZnDi3lJqhpa6PEUmC9UmNn8bNQ5gpK6GE4BZE0MYp:6v/7aHJYkhtPOCSmqNQep39y
                                                                                                                                                                                      MD5:D7589FCD8F385893FEF8986752B2BA48
                                                                                                                                                                                      SHA1:30C4CF3DE69FCDEAD0F72BFB136825A5781580B2
                                                                                                                                                                                      SHA-256:51FBB5B54BEF43333613E177E6F377F0255505D894B7A49EC4A8D0214F49F5A7
                                                                                                                                                                                      SHA-512:EA9A0C439B87DCF6D7BE5CADC33306A708E65DAD085ED2B80DA52D395F1EC94D880192F6A78E3B3FC83FE33869A46CEDC5F1B45C869A1FCB8926CBCF8CB0FDC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&.................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.01/10/12r......tEXtSoftware.Adobe FireworksO..N....IDATH.....@.@._.!a..C .c.v.#.l.G ...XP$,.,.......qO.%.^.#W.u....:....%.E..MVU......,.......[..5F]j..R.r.-..J.."wl.....]..+....Jr..=....A..W...K..........aQrX.'.."sNG.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\Menu_ItemLine_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 97 x 2, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124
                                                                                                                                                                                      Entropy (8bit):5.2365329415647
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlk9tjtUlog9RthwkBDsTBZt7AkxaF0lgKj/lljp:6v/lhP8il9jnDsp7AkIOiKnp
                                                                                                                                                                                      MD5:C2A55B0931DC44823739E79889305629
                                                                                                                                                                                      SHA1:2EE5B380BFDDFB42BED948700CF5BB13C5A7ACB4
                                                                                                                                                                                      SHA-256:54920D20C72AE27A69BCD9AA8B7FFFCCF426E5BF1F1FE9C9B6D52EC88C309511
                                                                                                                                                                                      SHA-512:319DE1DE9349183DCCE646FF5324774ACE6DBCBB156FDE257E0C8824050FE0A55965ADB221EB0EF37D1DD1DD877023E5DB89ED18E3EC0ABFA56A279274804A61
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...a.........Hf.W....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.ba``.a....X....s4.......M... `*.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\Menu_Main_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 90 x 90, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):429
                                                                                                                                                                                      Entropy (8bit):7.027670029830885
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/79g83RFotvL8BW6GP3iBPDuiFjz2FjzSUU1z:OR2+BW6YyBruCjajnq
                                                                                                                                                                                      MD5:068E7D17E73A64E56481E43845E41066
                                                                                                                                                                                      SHA1:98E04C0A41B7B23B493AE369C8682AAD487EFC8C
                                                                                                                                                                                      SHA-256:9458D373F72A1B3EC77983E9B54C15FD3CF220253CCF55F5FCE58F8C9B69BBFE
                                                                                                                                                                                      SHA-512:7FDB1D29EA435941C593E0323FC69B08CB9A22BD96A710C22A51000B6685582C7F313A5829D709B7FF78A15E28E922134845FAD19B66535022D4C79B6D1B2DF3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...Z...Z.....8.A.....tEXtSoftware.Adobe ImageReadyq.e<...OIDATx...J.P....$....S..Bg.\...mx.....-P2.v.R..Y..BJ..@.g....>....p.o<..}...*.e..H....#.[.n...-....v7.....K..k>...u...f...z.X.m.....[..U.4......K..4M?.....?..p.l.....h...4h..A.4h...Z.A..h.....@..h....@..-...4h..-.A.4h...Z.A.4h...Z.A..h.....@..h....@..-...4h..-..'.1..D1L'.c.~..|.d...x..>B....*\.q.2...-.iUUO.x./-`..........RF..y.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\shutdown\Menu_Selectbar_Topbar.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 123 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):165
                                                                                                                                                                                      Entropy (8bit):5.707320237772156
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPlaRthwkBDsTBZti9/6ks8F+haOZbinT666MJxjjvsS2Xjp:6v/lhPMnDsp2sOIupxsSWjp
                                                                                                                                                                                      MD5:C4975DD1D80A638F5612CAB2094296B4
                                                                                                                                                                                      SHA1:7C7A50A9E654D90A7A48D669C6F05DB35A7C8EFB
                                                                                                                                                                                      SHA-256:AD5FD871959EFB444511E8959EC00C4D08E9DADCDF7BDC4ED89D121B03A1EF67
                                                                                                                                                                                      SHA-512:33A8CDD1903472F9FA053A353C263E5A183DF2CFA48598BAF3C98D3ED5ECF7F8834482D687EF4BEA71188E25A4DD7CADF3C28D832A1905FDE6C31BC2140B2763
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...{...........Q.....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx...... ..01..lA@..[.?.<.p%0..1..1..1..1..1.l..l..l..l..l..l.................IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\focus_rect.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 4, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):149
                                                                                                                                                                                      Entropy (8bit):5.527268170923405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:yionv//thPktlhdzfRthwkBDsTBZtSFEsD90HolmQ6llFllMYbaljp:6v/lhPkt7dtnDspoEsD9KtOYbaljp
                                                                                                                                                                                      MD5:4BE614F17B9A598EC917BEF04529E419
                                                                                                                                                                                      SHA1:9EA298F834CB9B9EA96D96B0A3FE7E872DB32796
                                                                                                                                                                                      SHA-256:765AC96E62BD856CBB79EB1E9D57C92497CD4C184F6CB0BEF8689C14778410EA
                                                                                                                                                                                      SHA-512:B305FE3C41DD276EDF0DB7ADFC55917746458BF1F2E17D3BD83E4D457586D8ED4EAFF849C387EDF6A17B8C354E9A76011E24143C4DBF248B577A5FBA5E182ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............a.......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx...!..0........).......$..u>.uMW.......... ...'.....9.Dk.....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\switchtab.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6222
                                                                                                                                                                                      Entropy (8bit):7.920506651929059
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xvrkE9A/o2jn5bhhXuGmwcEuNDgNAJAP80:JSHIIHUCD4way4qt5bSSNPP8G8c
                                                                                                                                                                                      MD5:66D7D2B86E32F5655BA6AA56697D18FA
                                                                                                                                                                                      SHA1:B6D5750E0D7895AE4E4952DA6C4213D19E28722A
                                                                                                                                                                                      SHA-256:0EA9006939D0685CC3120110B4AC614F569259A586AB4E7CADA0CC7190E20B00
                                                                                                                                                                                      SHA-512:AB4239E8AE6E8A7DFB81770BCEA893FC71EE9DDE382FC3D926D06450826A01DBE696E26632ABED507D015057B87F633A619E408B1C655E705B0411A4327268D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\switchtab_hover.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6390
                                                                                                                                                                                      Entropy (8bit):7.930144662506158
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xEVtgavipddZ1SKoscmUcM1sTGo375EKeq:JSHIIHUCD4wa55pdddcmUcM2TGg76KP
                                                                                                                                                                                      MD5:887468977D334CBE59C487803D27A4F3
                                                                                                                                                                                      SHA1:1AF433168F1C258448CE5A39EC2D07633213CEED
                                                                                                                                                                                      SHA-256:EFBAF0D4704496A0A7F7F30976770811A698BE44A9C87FF7C1AF6B1DE54A596D
                                                                                                                                                                                      SHA-512:857E7E17B7BBD2B0FF838DBA55369BC567CA1D9089CA3515C1AA5C1E7ED2AABCC42B175A34E58DA5A005B3A0F7581AFCE8AE94167E0E513BE7763689B8AB7E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\switchtab_press.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 166 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6411
                                                                                                                                                                                      Entropy (8bit):7.93102043892213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:JSMllcHitlIxv9vk7C1+I4wWHLihk/xdcBFg/kGuKqfmsu1eFgM6cEIzMwfm0b2m:JSHIIHUCD4wazbkGlUmE/OhcuwKbH5m
                                                                                                                                                                                      MD5:4619DA1CBA62D6C1ABB08E10EC3723A6
                                                                                                                                                                                      SHA1:C8A7434FC19D607AA2367FEA3703D680EA93FDA3
                                                                                                                                                                                      SHA-256:55610EBC1855B87A25B623A973CBF770B5DA5F00CD1540AB83EEF0D86170F31B
                                                                                                                                                                                      SHA-512:656EBE00979B96CF5790DB9B44572D46209A7A13727FFFDFD88FEDD6F72990A8F8FEDA79D33D643E327A77829E47B2C3EC9AC88F184708AC14FB181DD5F12188
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............U.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\tab_select.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 87 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                      Entropy (8bit):7.263642219966577
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:6v/lhPo5nDs/ixy9VC71JV5QlwDlF/RgkYRx3UYTNEWE5dDhDe6z8u8YhP8Ojp:6v/7AO/iC215ZDlF/QxdNEB/BeyQYjN
                                                                                                                                                                                      MD5:9B77F45A4AA8FC4E8CAD0C95E7163A0F
                                                                                                                                                                                      SHA1:7B44938B1DB82D6E891E3ED727D84F96FE505838
                                                                                                                                                                                      SHA-256:D6C1C194B02B3FD7DB4E6667B95F0172E089E4555DBF6419C2226D477E283DA3
                                                                                                                                                                                      SHA-512:60BC92854741A4C79015AA78A65B57B0BF75717A9BFD182C7551BC2E78E768B5C2A83309BB6C64CF7E91C29677EE5D4E19D655E52208F6A2BF05CDA08B33834E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...W.................tEXtSoftware.Adobe ImageReadyq.e<...JIDATx..A..0.E......x.......y....m.......M&.......C._..F.1.6./y..2xA...+.B.. #.2...b.]......l..w.........f.<.........4...@.F...VP.2l.cJ.Y.4.aA..T....@.,.N..{......3.<..{..x.U..r...../p3.WV%,*.A>...J...R.]dw...Sn...k.JM]........^...(....H....-...dby.U......{..X.....W+......k.;.X.../....zoa..B.m..C@....EV.s.@.."l......lc.u.......IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\titlebarbkgnd.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 256 x 25, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                      Entropy (8bit):6.939067345587583
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:6v/7qULY+zoW7iP3NCTOKohMIyGalpB/mOYAsD:rkY9WW3NCTWlDaL8wc
                                                                                                                                                                                      MD5:6EC9F8CCE2C8BC2FEB5A371D555B0AF3
                                                                                                                                                                                      SHA1:BF9FB9284DE59BE049B6AC82A51FE32E904DC866
                                                                                                                                                                                      SHA-256:CE30716534A058D1A441B718E2147ACA2CEFD5D30E75AF258327E4DCB6A1DA02
                                                                                                                                                                                      SHA-512:E13B6F45EBB41C260087A66F4924470E241E112B55274A389D758286BA870C1A49CC0F0B468A54F265E88495967A4D7989487FCD30DE06F094DB6F883E47C826
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...NIDATx...Q..@.EQj2.p...5....4T...#.M4.xu!.cY..%...>.......u...~$.m...L...7i.V3...f.3.... {.g....`.......a..`.......P.e..3..q........s? .iMrT4.u......`h....:... .@..X.5':.....4..W.q..q.cf....{..{..4...,...[.,....0r[..P.g. N..%....Q..Ls......A..~..`.S. ..AX.2. s...&....t...%.. ...jk0.......I.^....t.lFk.U.....*.ph>....!.+..x.s....IEND.B`.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\topbar_cloud_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6963
                                                                                                                                                                                      Entropy (8bit):7.935090861076597
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:hllcHitlIxv9vk7C1+I4wWHLihk/xcA1Dx8T3C3t0ns2govxuslHOYFztaNbnZPX:CIIHUCD4wa9DKT3C9chVTtPz4NbnZJCM
                                                                                                                                                                                      MD5:4E274B00AD855107A73BE72F70EB3B00
                                                                                                                                                                                      SHA1:1B05DF55C346B444C14F8F53C9269C84871B9611
                                                                                                                                                                                      SHA-256:8334285525380F710EBAE6A588BFFC6B46495015B8372F0CA8A8587735350395
                                                                                                                                                                                      SHA-512:52C023689BBCA188B80A40C098B090A1E8781214C7D7A3C3B5D3D5B60CFB6D7593A91DD992E3CDB854BCC72C13B28C1AA87F3CE475C0C945A5A230B044609C4E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\topbar_fence1_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8501
                                                                                                                                                                                      Entropy (8bit):7.945548490487696
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4wao20ykf6aHnm0azTVdrC4SFC9uhw0igx3SCrHaJQ:p50wNykJHpa3C4wCD03SCrHQQ
                                                                                                                                                                                      MD5:40ABE5225DFDF0E6B488DCF0938D562D
                                                                                                                                                                                      SHA1:A654021E7985860D8CB0E626DFCBC391CE61278C
                                                                                                                                                                                      SHA-256:6DA03EB32ED39A47DBE7339AE7297B7B4E8E9D3FEB34FDE1A506EF92B34BF2EC
                                                                                                                                                                                      SHA-512:04076C5EC83B039C0E81EF97BFAC3814CC7C4E4696D88AC63B1D900092E167A634C81E3AD9821392E85726DD497D577306F27715B06A961495DD43AB1F31C34C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\topbar_fence_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7875
                                                                                                                                                                                      Entropy (8bit):7.934182540133754
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:GSHIIHUCD4waxj6oGEsTiTAclfPxcAC/xuwS:p50wq9s+sACxuJ
                                                                                                                                                                                      MD5:C094E7E0CE55802C759CA416DB03E2CA
                                                                                                                                                                                      SHA1:B4A2830E0B2477DB91927F9C0B810DFD8AC0F6B3
                                                                                                                                                                                      SHA-256:CB77FF1EBA0FB33C02DB4E3123B6579578E730156C853CB4DAE86FCF7EFC7C0B
                                                                                                                                                                                      SHA-512:86E6436F3A017CAA3FE606B35D9FFCA6EC9006A28C9FD9CED44A58E16309CC680805B688155470428ECF2EFF010E3265391CCF2DD10C2F233E0CFF2B3C801A04
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\topbar_shutdown_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 213 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8971
                                                                                                                                                                                      Entropy (8bit):7.929301739898825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:PSHIIHUCD4waOr/huspoQOjWbrL1npMENQUGUZSKU4ykuo:650w9DhNpvOmrNppPGzkuo
                                                                                                                                                                                      MD5:EA60769EE7F89D82F1A505FA2522E69E
                                                                                                                                                                                      SHA1:AEBC01077C372CE40DBA17DF6DD2F13DE3E8C4F9
                                                                                                                                                                                      SHA-256:D7095555C2BDEFB77C04750B1089735CC7E499559622B00F6B4F09924865A09D
                                                                                                                                                                                      SHA-512:286E77D283E648BF1965287F20BD51B5A8F227D4D395EBD467AABD85A15CA152FCAC53AD1E5B5EDA2621A10852B65EC041978FEFF0673D2D1A3327B44DC39EA9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR............. .......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\images\topbar\topbar_wallpaper_button.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 186 x 26, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8530
                                                                                                                                                                                      Entropy (8bit):7.929926536351136
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:CIIHUCD4watF4l7QNTtGIGS35K/DMUEh/4x0T:s0wDa485Kb90T
                                                                                                                                                                                      MD5:210C4825C40B7602E8D488A6AF249840
                                                                                                                                                                                      SHA1:C862E03161C390A46E96FCD054EC7100975B6B2A
                                                                                                                                                                                      SHA-256:BA31ECE420CB6C663260B5A30C22535BE21F2E9D8551BCDFFFA3E38AF5E08E72
                                                                                                                                                                                      SHA-512:4420FB21327E9F18BA2B6F9133DC5B66CA7618EB29EA7EAA10485CD0D625CDDA9C55637F18E323AAAA60CC1D3DC2109A555FAA1237627D458175E7EE82179780
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...............F.....pHYs...........~....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\msgboxdefault.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):69514
                                                                                                                                                                                      Entropy (8bit):7.9663405548715005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:krWIqkJFHdpnNdByNNIF/eLPhkDqrOYW1WN8mmfM+6wGsOf8:kKIqY9pnhyI/nbYWN9fp6wGNf8
                                                                                                                                                                                      MD5:BF2D177C27F47BB75E96CE4007BB6E9D
                                                                                                                                                                                      SHA1:B1653699E3AB0C4DD7A6164482562F63A64825EE
                                                                                                                                                                                      SHA-256:92B76492DED7A2DD0462534D85A14B9048F454B5DC01CCB822C2657D2DE94F61
                                                                                                                                                                                      SHA-512:42475CCBD629215402EA2FF8418A37C01A4A089DCEEAE774F5B87F5259842A670876E3D82BB669EBB22A748BC30C713E975D6872BD63A7869B4D9760542F79F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK..........A................app_permit/PK...........A.V|...........app_permit/bg_broadcast_dlg.pnguSg\.g...G.eC.Me..b.FJ.a....r....);F@.B..[.:h.D%.j(C..A%.:h$*((.jI.R@........{.w.....D.Z.Z........@(...ZC.......J..@...qm.^U.B.....bkk..................jnn............K[[[KK.@kkk........ ......`.........._...6m.HUU..7.mgg...f.....-[6..4ioo......o.....70P(...D.P.c... ._.Xl||...bcc..".H///0.n......D..>>>`l...................!......@0.zcbb....m..6...`v......U`d..h.....zzz..../.m..*P.........I...`....&..+...5.ZCC.&}...>....................&&&@.....dhhhjj...............6....(--e2.4..J...o.=UUUeee..............P..Cfh.m!h.jA..........@ @3P..`...egg...C.......{.B3%%%999YYYt:=--.....CEEE..4\YY.|.A$.a..|...E8.......\,YQ.V.".D....L......U.D,Z.).....W...[..wmj...a..b........Dz...7..{P.....o.KpC...R...T..!..ej.Zr9.R....\...JeR...D.U.....:J.A,.AE.U..-....b@.+.-c.N.#.j......s.....M...?...*..@.s.K.<o.=>..3.y9....y....T...t..a..*XO[..M[.A.[...vv..m..._..hj.bVK

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\wallpaper_ext.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1200, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):124869
                                                                                                                                                                                      Entropy (8bit):7.8586212482770925
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:5HVJ/O7/nvJg8/S3N2WNURmuxg64MBHzCiW2hV8:51J/qBuNURmdMFzCN
                                                                                                                                                                                      MD5:0ABD919C48DC87BA83894DE37F59168E
                                                                                                                                                                                      SHA1:9516BCAF9217E5BC06D8AD98955D15EEE2AD31E4
                                                                                                                                                                                      SHA-256:2D93B952B91FB6B1A0DA07C79481969D81AB1162D7FDE47318C4A380B1E11232
                                                                                                                                                                                      SHA-512:BA4E0BAE873A7ADB5EF5F8B17E04C93070E7ECD6B2D1D936C65EC139F06283D8E9B1F61614FA04A838EC45066227B5C391885EA4D2DA354B858450A25574C2CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]...h).z..?..............Z.Zc6.?*\.AO.=...i].&7....>..U\...Z..2:~..f... ..-HM../.R`z.E......l4._.+...>..O.Ojz..Ke).......*.=.@1H.....O..B....?J......S.......s.Hs....E.V.A...U...NhE..OA.j[..(..J..j.H...16=.?J..9....A....lr...Q.LA.Q.Y..$A...j4.?J.>...L.D.2...Q.T.1Y.6.#.T.9.F0~.*..FRd.8.....jx.k).I.F..S.....4Cue#.2d.S.2*.......l.T.S..A.*x...c

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\wallpaper_ext_cm.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156024
                                                                                                                                                                                      Entropy (8bit):7.91219178621967
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:UrbrR01dOnT7Vij70gx7USHNlZOu8KA4zL8nQt3LwZtCF6I8fPP:0Q4Tpm7tHNlZOu7AkLHtUk6RPP
                                                                                                                                                                                      MD5:C252183A655AC31D68FAC62B2EFBE9DA
                                                                                                                                                                                      SHA1:1FBA37D683AC3C1B5D8728C6E36ADD321D4950B5
                                                                                                                                                                                      SHA-256:5AD1C275D26508B33EC5351E98DECE5A57B44E28F5148D4086BCE42849FC4652
                                                                                                                                                                                      SHA-512:16DD57A536D605A2CD1E0E9C353EF7B38A3CAEF2B65AD2A7B2FC45E44AC4DCEB9C39DCCD96899FA4272052D1B5A06228541E903332522A665040CAA275A0F9A7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`......Ducky.......d.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in I

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\skin\wallpaper_ext_disney.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=10, bps=0, description=MM], baseline, precision 8, 1920x1080, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):226312
                                                                                                                                                                                      Entropy (8bit):7.928187073953822
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:r2uaobNMFprpj438z5owJWnUSyg2bjrMNolvOV:aIOpLan1gjoNU6
                                                                                                                                                                                      MD5:4E590ABBCAF2E93A86D82967DB90C3D2
                                                                                                                                                                                      SHA1:D3A001C95C111303E76E6586C389A792C3DEC12D
                                                                                                                                                                                      SHA-256:B0122CFB3000507F6D3E7C8BDCEA3CBE3180C55DB3808D7EB56D3F1F7655D588
                                                                                                                                                                                      SHA-512:99F46925750AA6D243DE3603BAEB14FBE59A8FB95DB01CA51C635D51D78394894D10B64078B46BBD27CEA6A7A6A53C559AFA87AC939DB19CE8607E148C891E58
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....H.H......Exif..MM.*...................................................................(...........1...........2.......................i.......................H.......H....PLACEHOLDER APP NAME..2012-09-11T14:30:14+08:00..........................8..........Ducky.......d.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.].......1(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(..h.h.(.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\softdt.dat

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1827013
                                                                                                                                                                                      Entropy (8bit):5.41048404727452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xySaSXSOB32qASWU9yxySLy+rXRrHgHteuSlS7SYS4SJgngg+YaTknk2yXgbVBXd:kSWUr+rX0aN27bVv
                                                                                                                                                                                      MD5:11B68803967B16187CE965E0C5D794AB
                                                                                                                                                                                      SHA1:0F542A3C04AC9C70177932D86C1BF60A1CBE2685
                                                                                                                                                                                      SHA-256:E66CD1FA12EA9CCA000927D56016CDE62F7BD4BAA8CEBAB4B28C0A59B03ADDB6
                                                                                                                                                                                      SHA-512:5DE6B8B008FA04C41857E261DD7B7566DB65A3F58A8DBEA2085DB26BD068EDCEDDE0528E93AC76512315B5D57E34CC43A16B6286616B97E3607903BC4AEAC28A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:NXF.f.................I.D...N.A.M.E...O.S.V.E.R...O.S.B.I.T...R.E.G...L.I.N.K...R.E.G.2...L.I.N.K.2...........+./.3........................................[...Software\Microsoft\Windows\CurrentVersion\Uninstall\{75C28575-99CD-476F-A063-FEF9B445F4EA}.....LogFile.......\Setup.exe...........\Setup.exe....................\Setup.exe.............................".&...........uibia.................:...Software\Microsoft\Windows\CurrentVersion\Uninstall\uibia.....DisplayIcon.......\Uibia.exe...........\Uibia.exe....................\Uibia.exe...................\.......#.'.+.....7..w..........d...............;...Software\Microsoft\Windows\CurrentVersion\Uninstall\.........UninstallString.......\ChanjetKdt.exe...........\ChanjetKdt.exe.....................\.......2.0.lnk.....ChanjetKdt.exe.........ChanjetKdt.exe................\ChanjetKdt.exe.......................ChanjetKdt.exe.......................%.).-...8._..j.............................._...Software\Microsoft\Windows\Curr

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\softsignore.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1007), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1560
                                                                                                                                                                                      Entropy (8bit):3.68414519403534
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:3ufoEOb2RqTYQoFLZqCmuLX1Slud8oW/chOPd7uxsB:efof6RrL4eLXJdK/2U7US
                                                                                                                                                                                      MD5:805AF2418D2DB89FEC07E15B0819306E
                                                                                                                                                                                      SHA1:CB372027D914B4B4DF8A40598FC80663CF2CDD6C
                                                                                                                                                                                      SHA-256:9CC6239898C8175A464CE590A4D9087B8BE89A368983FBE3179299240BD85EC1
                                                                                                                                                                                      SHA-512:70DAADA11433C0A4788B790B1C5452007904908A08D324AE3231E1DE9F49B0C613FF8C1627BBE340DF2B601618FB18C5B50D4A44CEE3E2B191E98EE89D552FC8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<SoftCtrl>.. <IgnoreSoftlist value="11,12,15,37,38,43,112,158,203,260,313,10023,10056,10119,10132,10156,10205,10256,10257,10273,100949,100953,101175,101519,101922,102081,102433,102433,102508,102726,102857,102865,102916,102919,102990,103041,104551,104743,104975,105012,105334,105457,4150067,4150679,4150740,4150760,4150761,4150762,4150763,100100507,100100849,100101376,100101838,100101893,100102245,100103618,100114158,100114658,100115299,100115773,102000378,102002942,102004803,102005105,102005515,102007221,102007663,102020154,102020156,102021285,102022833,102022857,10182,101084,102835,104734,56,122,10158,101153,101533,101665,103076,103414,104915,4150589,4150703,102021678,102987,103070,103839,103074,351,102007168,100814,102754,102023531,103804,103853,102432,100101243,102479,48,102434,103116,100807,100809,103858,309,10177,10197,10200,102049006,102049008,100813,100818,102064269,102004518,102105508,102105509,102190366,100115779,100811,104698,1001019

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somQuickInstdt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):388456
                                                                                                                                                                                      Entropy (8bit):6.442900380359452
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:KHmBujRyg2UZO8dH2wi4ZF5sd9EbN3W09QqLNRvk9Mr9mcF0+ghddwgXcDWejmRO:SgYRyPUZOeri4ZF5sd9E8GNDrQcIdTX8
                                                                                                                                                                                      MD5:572E8D9AF871FA484DB3BFAE444E4C0C
                                                                                                                                                                                      SHA1:229A15E9FA3E389AB9575A297963437432CBD776
                                                                                                                                                                                      SHA-256:23E505F80D5A1DE15AFC6E015A062315237E92114BE9B7F9025F36F66D982315
                                                                                                                                                                                      SHA-512:1562BB358894AD463BD5131844CC206A473C44C325045C8C56C8F7B203631F37CD31122C1624E4F509B9B324508DE02C8139F9B1299DFB183D5643DC5C332D9D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.P.y.>.y.>.y.>.p..`.>.p..7.>.p...>.^NS.{.>.^NE.b.>.y.?...>.p..n.>.p..x.>.g..x.>.p..x.>.Richy.>.........PE..L...L7.P...........!.........4.......T.......................................@......&H....@..........................o..f...,\..........................h....... 2.. ...............................X...@...............t............................text...'........................... ..`.rdata..............................@..@.data....@...........X..............@....rsrc................t..............@..@.reloc..._.......`...z..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somcoredt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):825008
                                                                                                                                                                                      Entropy (8bit):6.5491447938841825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:eY4r48i/je7GlpPMDV3be+wkhrx5dR/bPkuaYLdp2ku5ZGSlpTs6ILauDp:qr48i/j8YPMRrwk/RasdQkATfTB4p
                                                                                                                                                                                      MD5:AD7141EBC34468ECE687A5399FB1B05E
                                                                                                                                                                                      SHA1:159079879E57D6C1E4E599D7EBFA58EAC289D0F4
                                                                                                                                                                                      SHA-256:451ED78D762B64984402DC939228C00AE608FC9D1B1BC3BF6EDB767F27462FAF
                                                                                                                                                                                      SHA-512:99921BA6E7EC23C47B3AA9A275ABAF42B80EAF25773EDF13CD50DB60A00CEFB393DC376C238C31D1D66661771A2FB6844DFC576C2C325D29749E431EC2516A17
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......67..rVb^rVb^rVb^l..^wVb^...^sVb^{..^hVb^{..^.Vb^{..^.Vb^U..^tVb^U..^oVb^rVc^VWb^{..^GVb^{..^sVb^l..^sVb^{..^sVb^RichrVb^................PE..L...u4.Q...........!.....................................................................@......................... ...F............ ...............|.......0..dq..0...................................@...............,............................text...Z........................... ..`.rdata..f...........................@..@.data...<r.......>..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\somkernldt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1257928
                                                                                                                                                                                      Entropy (8bit):6.637557852291585
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:kCHfpvtT6uNohYg07OmzFCN26/5JIqfjNm+uoSNt7LJi4uUDzBeDpnE2IVs5Puwj:kCC5K7OmzF57Puo0aYuTBcPP
                                                                                                                                                                                      MD5:B04F80F63C9A0ABF6A287ADC4AC661E4
                                                                                                                                                                                      SHA1:54E9CB2396FD8708CF40B44F8D51DECEA38BC52E
                                                                                                                                                                                      SHA-256:BDBD8D832B8C6E8AFCFBA93FDC656629A34D7721FD2339D346A26FF2495268C0
                                                                                                                                                                                      SHA-512:7B9DDAB383E7482D05FB20A6106C2044779AFC2CBA557B953C812A8872B1272593BDC656C3BD2C7F70126BB4A852958BE84EEEAE69F3C9C12DA46C2140A9F4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:d}.:d}.:d}.B.}.:d}.B.}.:d}...}.:d}...}.:d}.:e}=:d}..v}.:d}.:d}.:d}.B.}A:d}.B.}.:d}.B.}.:d}.h.}.:d}.B.}.:d}Rich.:d}........PE..L...'..P...........!.....h..........................................................`.....@.........................`...[............0.......................@...}...................................................................................text....f.......h.................. ..`.rdata...W.......X...l..............@..@.data....(..........................@....data1...............d..............@....rsrc........0......................@..@.reloc..|....@......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\sqlite3.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):423584
                                                                                                                                                                                      Entropy (8bit):6.683424538324543
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Yz0fZUselMRqlkPUyZWTQHkK67VTZ6pGBdmkRL6iH3/BoqnuF:hSyZC7WpGBdmkRL6ipo+uF
                                                                                                                                                                                      MD5:4D1B78591D892A54DD795AD3F7336756
                                                                                                                                                                                      SHA1:7935FB2758003BB3BBE9C58811DB71323FD66353
                                                                                                                                                                                      SHA-256:2938CCE7F5716AF3D6317D1617DD3B2E8C212A11FD91DE95AE0713D8E2FFE0C2
                                                                                                                                                                                      SHA-512:17A5D93430A39F55CFFBD892B89560710B082555D714EE629C5E399B386B3F5A30F6C47E202E3E3FE8637DDEFE2C98D0CABF8DD67D10A0555719A6F765129052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.?..kQ..kQ..kQ..w_..kQ.yt[..kQ.ytU..kQ..c...kQ..kP.TkQ. M[.YkQ. MZ..kQ..mW..kQ..KU..kQ.Rich.kQ.........................PE..L...k..L...........!.....0... ......)7.......@...............................`......8&...............................|..W...Xw..<....0..`............`.......@.......A...............................................@...............................text...6(.......0.................. ..`.rdata..GS...@...`...@..............@..@.data..............................@....rsrc...`....0.......0..............@..@.reloc.......@... ...@..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Bin\weather.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):543
                                                                                                                                                                                      Entropy (8bit):4.60036984037006
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:jLsp/jF1LOoiP4dylCXLUbAzxAyMwULoyL+3LooRLooPW:jLsp/moy4dvLUn1ojMoqoO
                                                                                                                                                                                      MD5:363939D1E1EE9B4C87BCB89A6FDBEC23
                                                                                                                                                                                      SHA1:C89070691467172CDD9DB746F334DE04C8D15C40
                                                                                                                                                                                      SHA-256:CA7F4EA477051052B21FFA401343E2932A5C0E0EF2950C4B06EA6E859D1846B6
                                                                                                                                                                                      SHA-512:48987AC164A62444D54C1EF070FADEFEAC04FED87842E248981B5E8143778609EAA03BA66CEA15925275F0C3F51868DC6619618E2C9C5593B19CA6AFA3977C7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[text]..0=qingtian..1=duoyun..2=yin..3=zhenyu..4=leizhenyu..5=leiyubingbao..6=yujiaxue..7=xiaoyu..8=zhongyu..9=dayu..10=baoyu..11=dabaoyu..12=tedabaoyu..13=zhenxue..14=xiaoxue..15=zhongxue..16=daxue..17=baoxue..18=wu..19=dongyu..20=shachenbao..21=zhongyu..22=dayu..23=baoyu..24=baoyu..25=tedabaoyu..26=zhongxue..27=daxue..28=baoxue..29=fuchen..30=yangsha..31=qiangshachenbao..32=fuchen..33=shachenbao..34=qiangshachenbao..35=leizhenyu..36=zhongyu..37=leizhenyu..38=leiyubingbao..39=qiangshachenbao..40=dongyu..41=dongyu..42=dongyu..43=dongyu..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Config\config.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                      Entropy (8bit):3.79579144964755
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:QlL+C7n1BmzDCf9IDqBJDFc7pBs8yEM37u:y+gUDq9IDqBJDFgsRK
                                                                                                                                                                                      MD5:4D9817E1478EA6690C1277A308224B49
                                                                                                                                                                                      SHA1:6834CE180449BC0490F5CEDC1D0A544BCDEE6D52
                                                                                                                                                                                      SHA-256:E778500AC0F8A428088D08F8D572A61506660BFA8CA973312E507FB06296FFFE
                                                                                                                                                                                      SHA-512:DEFB5BD008B6A403FA28EB69D3D42C10185DE17287ADCB722D4F4CF1857BC0AACE8F62F8ABB7AC734931BD4207929DB331A8D1B237C5C82E6C4AA811F261B412
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t...C.o.n.f.i.g.>..... . .<.d.e.f.a.u.l.t. .D.e.f.a.u.l.t.S.k.i.n.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .R.e.p.o.r.t.U.r.l.=.".h.t.t.p.:././.s.t.a.t...3.6.0.s.a.f.e...c.o.m./.3.6.0./.?.s.t.y.p.e.=.c.h.a.n.g.e.s.k.i.n.&.a.m.p.;.v.e.r.=.{.v.e.r.}.&.a.m.p.;.t.y.p.e.=.{.s.k.i.n.i.d.}.&.a.m.p.;.u.i.d.=.{.u.i.d.}.&.a.m.p.;.p.i.d.=.{.p.i.d.}.&.a.m.p.;.m.=.{.m.i.d.}.&.a.m.p.;.z.t.=.{.z.t.}.&.#.x.D.;.&.#.x.A.;.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .M.i.n.U.I.V.e.r.=.".8...0.".>.<./.d.e.f.a.u.l.t.>..... . .<.S.k.i.n.>. ..... . . . .<.I.t.e.m. .S.k.i.n.P.a.t.h.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.". .S.t.o.r.a.g.e.F.i.l.e.=.".d.e.f.a.u.l.t.s.k.i.n...u.i.". .S.k.i.n.I.m.a.g.e.=.".c.o.n.f.i.g.\.d.e.f.a.u.l.t.s.k.i.n.\.s.k.i.n...j.p.g.". .D.e.f.a.u.l.t.S.k.i.n.=.".1.". ./.>....... . .<./.S.k.i.n.>.....<./.R.o.o.t...C.o.n.f.i.g.>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Config\defaultskin\MiniUI.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8526
                                                                                                                                                                                      Entropy (8bit):3.7460406251141674
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoSjPRcUwj8jVcxsuJTq:8kYJArDGutyofFmTLo0YuVme76Djh9q
                                                                                                                                                                                      MD5:7FE166CB6A292C773FA9E9EF24902C53
                                                                                                                                                                                      SHA1:A7FA9B538A374786E7F032253D1220F4F4E840E8
                                                                                                                                                                                      SHA-256:2B71B204D258B1F0913829E36E9298DBC57E379CD816FD20A99F847C0D40F51B
                                                                                                                                                                                      SHA-512:BAD15571C55688CAA12CAAD0D87559250C3D2D551F37C47089DFF2E83B42BB7EB61AE264CC589C4ADF4678A0689DD717F833D73FEB35732138FAF2347C087558
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Config\defaultskin\Skin.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                      Entropy (8bit):7.4708457614959665
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:9WAO0VemNE93teoHzouyxWcT9xqP6bXZ+1Ei4P9rv/QAYA:wA/VemC9RzouyDTqP6Ls6dvN
                                                                                                                                                                                      MD5:5D1059252A64312D62181DAE70A16EDE
                                                                                                                                                                                      SHA1:F17C67E0BEF6607EE0521A56C08DC1BBB0E941B5
                                                                                                                                                                                      SHA-256:C3283EAEBA5DB93FD5A4F6EF457080C86822BC7B51A85284F46C98E1E6C45338
                                                                                                                                                                                      SHA-512:0FA4FD465CFBCC9C362C9319D4E4B320283E2693061ECBFBF00F9DB1FDF6BDEB2B27EF79B31DA60BF8D1CBB71BD5F872945339A42153A8E0994E610450A99C6D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....d.d......Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.a..".....................................................................................!1Aa.R.q.Q...."23.Bb#$.......................!.A.Qaq.1..............?......]....@.. .'0.=....]_.(..K!{..._J..|...MC....&.mm.:.....R.%.i...h8.b[.s.@..h.=.ss..1....bD..bc..b..E..Sh..vK..........b`$f.b...Ub..Za.|...7...=S......T..8:.>.X....~kg..$.Z..e...''..s..K..j!.....SM3IM.K.....M^.c.]K..Pz*.ER.D,..Zi.Ji"..C.SM3K..H.}.zj.L1*....O..4..J..%T..4.J.Q.Gb..0..ZK\-p4sN....UV^wj>.R...+.;>1...E..6..:.jw....W....#.n.75..)o..T....:7J... >J..a^.].~=....p/h(Sb.!."7G .....[..-...T....<..zaQ.%...`@.6....,v.....z<?..'`..O..h..........h.qr.x..Z(~m..wj...]1....|....*,.3..+..a.Voi...-N..UY.2.r......Y....d./.....f.c...q.M6+...XW.x.s.K..>......=..7i...m...m.z-.......]B..K.....n..{Tc.....`..`

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Config\defaultskin\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4162
                                                                                                                                                                                      Entropy (8bit):6.708321825965058
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:ktEM1ltFGWl1p51PO9l36O9IWHWkuRIJP0O2eH1++2M1v4efxwxWYaHc1n1yZMTt:K3LC+LkDJP0O2eR1v5Xc1Iz8t/7waX
                                                                                                                                                                                      MD5:B0EA1C6C589490799F85F857C374A486
                                                                                                                                                                                      SHA1:C4B3D4BFF4732736317B64CB2F165A134814E1B6
                                                                                                                                                                                      SHA-256:C24FCC10269E74294E590A25166FDCB8B19DD8E97980D8F5A01AB09D3E8454B3
                                                                                                                                                                                      SHA-512:FE9994D594CC0872CA2F5ECAF74E2AC4D3B00D71B69D3C6B75358CD485CDB0C16E455F07EDC86EC36CEB93FB44E018932C18188979A2984A6ABDF2BB0A9C7337
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........|.@................Common/PK.........=<.|sc............Common/checkbox.bmpBM........*...(...............................}...}............Q..!.!......................}...z....5...:...@...F...L...P...T.....................................................................................................................................................................................................................................6...>...C...F...H...N...T...Z...[...c...g...j...k...p...t...w...z...z...|...{.......................................................................0...3...:..................................................................................=============.......................................=============.......................................=============.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=.&%.,+)ts.....TRSXZUNrKqp..>2<;1:98777.=...........=.'&/.,*(s.....TRQPOMLrKqp..>2<;1:98777.=...........=..'&/.,*(s....WTRQPOMLrKq..4>2<;1:9877.=........

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\DumpReport.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):216704
                                                                                                                                                                                      Entropy (8bit):6.532910128712557
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:l6VgjYzDal0nZySd3cZeC8PLErN1wuLydldZG649oL7xG4KKLylg5KMit8GC:kGczDu0kSdMeXLErN1wuLAlY9GdG/zbC
                                                                                                                                                                                      MD5:E2CF8C3384795D23631D1A1B86E33FDF
                                                                                                                                                                                      SHA1:FE160C83C7BB1EA2C8D4494C7BF91474B47CA5D8
                                                                                                                                                                                      SHA-256:319227E2202B3B72CE20107A5FD05B90E89A69492D9F5DBACA3EDA95D2C86AD3
                                                                                                                                                                                      SHA-512:AC579907580185D7809736AF2037623DFFED5F83B8FE0474238233EFE20F3001176D5007F0360F281E6D1DCC1EA74146681E642FBDF48228227ECD7998AFB822
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..q:..":..":.."...";.."3.."#.."3.."...".x.";..".x."-..":.."..".."1.."3.."w.."$..";.."3..";.."Rich:.."........................PE..L....q.P.................f........................@.........................................................................$........`...............8...............................................................................................text...ld.......f.................. ..`.rdata...~...........j..............@..@.data....P.......2..................@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\LiveUpd360.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):399344
                                                                                                                                                                                      Entropy (8bit):6.525659947793564
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Q60nOaN+UpBOp+j1stF+sb6YkgXti5Y2ch+:QJ06fIQ5Y2S+
                                                                                                                                                                                      MD5:77106684F45C7C504B21AD948956734E
                                                                                                                                                                                      SHA1:5043039A8BC35EE71D8F17B921F35D6DEBF01831
                                                                                                                                                                                      SHA-256:F3803AB55BBFFFECA21BAB8BED43004A0DD019B1A97196602825E1D1D61C9554
                                                                                                                                                                                      SHA-512:4DC02E47B6071395D7CDA332CE74109F92682C7A00346C3DC0160D9747881D78A93F38B20A7C4CEB1B5E25B1E6CC86D3AAC98780AE40F3378C4DE007CA951C9D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qW. 56.s56.s56.s...s46.s.y.s46.s<N.s)6.s<N.s.6.s...s"6.s56.s.6.s<N.sU6.s<N.s46.s+d.s46.s<N.s46.sRich56.s................PE..L....q.P...........!.........>.......+...............................................l................................../............@.......................P..|....................................U..@...............0............................text.............................. ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@.reloc..@D...P...F..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\LiveUpdate360.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):811656
                                                                                                                                                                                      Entropy (8bit):6.876739267086473
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:FNi+QMNY5S0yQVkt/ozaCcTG8ky/D4CUpkJ8:FiboQWRozU/D4CUpkJ8
                                                                                                                                                                                      MD5:41D9C718B95D971613AE0DD97487A3B0
                                                                                                                                                                                      SHA1:1294F7361FD7CF3B40ADE74E72B1140C9C4CCD4D
                                                                                                                                                                                      SHA-256:DA3AE4C54360E717F727F09152B5BBC91696501BBA4DEB727ECB868D1E66E818
                                                                                                                                                                                      SHA-512:6E9ECDBE00F05CCCBB33013EFAD0661D0EB9FBCCEB1C4BFE24D619C06A34DEC9817BE2E53A925B34BB769700A4020247958C60C11B954E2A24CBD9BC4E635B7C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O...O...O..@.4..O...77..O...7!.SO.....O.....O...O...N...P...O...7&..O....6..O...73..O..Rich.O..................PE..L....r.P.....................J......UX............@..................................G..........................................@....................L..............0................................................................................text............................... ..`.rdata..............................@..@.data...Xt.......@..................@....rsrc................<..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\PDown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):210408
                                                                                                                                                                                      Entropy (8bit):6.507157820903005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:TJnuJFUvm00JlB8uLp/Me7AQo7ZWQueVMAI64kliFa/nyG5e0P9:9nuJFUvSJP/Bid9/VMg4klfiI9
                                                                                                                                                                                      MD5:23944F2C8C2614814CD9EEEAD7C15622
                                                                                                                                                                                      SHA1:FE5BFBED6900D976AC56EAC386423D82A35BDE7E
                                                                                                                                                                                      SHA-256:68CB47636533713F460FA932975189BEFB0DDCA0750E8F75418B6C616F9BA3BA
                                                                                                                                                                                      SHA-512:C16AC9EB39375950E554CB6C2814ECD385D39F2729DC2B26618647705D99DE7A2626759C3DEEB8C8A12E7658ECE6A5569FB1EF5D01B8F1CB8CFFAD7EEFE92555
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................o.~......}......k.A....K.........h.....l......z......|......y....Rich...........PE..L....q.P...........!.....L...........N.......`...............................`.......3............................................... .......................0..`....c..............................`...@............`...............................text....J.......L.................. ..`.rdata...y...`...z...P..............@..@.data...@<..........................@....rsrc........ ......................@..@.reloc..^*...0...,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Safelive.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):397240
                                                                                                                                                                                      Entropy (8bit):6.559659900193761
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:gG1eHqeh0S21bC5k+5HsprlHPohiLesYTM7Pol5Cm6Kmvn7/OZcnPxNWj:h1eKeDp5kwMprlwYlYUPol5Cmdmvn4j
                                                                                                                                                                                      MD5:EF03AA3534F302E6A4DE1FA6BB6C9678
                                                                                                                                                                                      SHA1:6A67D0BD8BDDFBE0479BBDD4166281FF3DCD0D7A
                                                                                                                                                                                      SHA-256:E7CCEAF1534BEF4F656E72C8069BC82BBA836774868A39F5691E7D4BF9EF6450
                                                                                                                                                                                      SHA-512:650D9156F3A185801D1B57845ECEDAEDF1A392E5EB8341E5537AE082FE8D7D3749B30B6878A41EB4BF9204C4DAC535C3614859B1CD65D25CACB95695FA383540
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}..S2<..}....?..}.....}.....}...}...|.......}....).U}....8..}.../>..}....;..}..Rich.}..................PE..L.....kQ...........!.....z...v.......U.......................................P.......................................j.......S..@...............................L5..`...................................@............................................text....z.......z.................. ..`.rdata...............~..............@..@.data...D[...p...6...Z..............@....IShareO............................@....rsrc...............................@..@.reloc..2O.......P..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\Uninstall.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1146032
                                                                                                                                                                                      Entropy (8bit):7.1292448119285154
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:+jcxTzOiH74zs4urel9BlKfEZzss4Ueh4ffGs6bW2iYjS:+j1CKorel9icZzD4fh4fP6K8S
                                                                                                                                                                                      MD5:B856763537C16C746EDCF36EFC187930
                                                                                                                                                                                      SHA1:E384680D705C4098FF825B2B0F2ADD6FF7C40BA5
                                                                                                                                                                                      SHA-256:585AFCC72620246453007DD33819E85F8B677DC2896C81BBB25F3A8BD05E4F68
                                                                                                                                                                                      SHA-512:4F9A69E2689F4240C569DC3AB7CEB0C5EC094B3D355591F6EE30A3A6B15B7FF11DB2E7FB0038A5011F0615E68DE8D7FCBE2A193A88646EB2D129FD45DD37B133
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7I.OV'.OV'.OV'.....KV'.F...SV'.Q...JV'.F....V'.F...\V'.h.J.KV'.h.\.hV'.OV&..W'.F....V'.Q...NV'.F...NV'.RichOV'.........................PE..L...3w.Q..........................................@..................................-....@..................................>...........7...........b....... ..Dt.................................p...@............................................text...,........................... ..`.rdata..............................@..@.data....i...p...>...H..............@....rsrc....7.......8..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\AppBreathLight.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\DtWebmailHost.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\LoginAlertSwitcher.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\Music\SelectMusicConfig.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\Music\douban\douban.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5144
                                                                                                                                                                                      Entropy (8bit):7.924303008935322
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:jSMllcHitlIxv9vk7C1+I4wWHLihk/x/XRzAd/7rtYWcuS4TV/zoCQG:jSHIIHUCD4wanAdvti4TWC7
                                                                                                                                                                                      MD5:278C49FB3BC908F88B2FCF0C59A3EFA4
                                                                                                                                                                                      SHA1:4DAF8D31656B057973261DA592D210486B2A5E63
                                                                                                                                                                                      SHA-256:64AC53712D212CA020E4FC8D5DCBC262AEEA36084647079D0B3F9826BC0D1BB9
                                                                                                                                                                                      SHA-512:623266DBDE05F850F99B8AB31239CF2183B620079D8E5D1CC193EFABEE527192BFFE90C3EC4CD2C96483AEA64E7A5F3A4DFBD98C35556BF254659FF17A2C57E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\Music\jingfm\jingfm.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7971
                                                                                                                                                                                      Entropy (8bit):7.956521088757676
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wauVFxHUELpeNDF8pW+ZYibvAmX:W50wzbxHpeGb/b
                                                                                                                                                                                      MD5:E670AB623C433324324FEC4B53DAB011
                                                                                                                                                                                      SHA1:82D79DCAE81F58EABD8EF76C17EC6057F13BD9D8
                                                                                                                                                                                      SHA-256:880D829FC1F50EBFD4567F21D190966BB6283C03D5ABEA5C05753DD73726BF6F
                                                                                                                                                                                      SHA-512:E206D1D4BFE38D2000AADB54E797F192A4DC364C24F53972D6FD64F975C6B68E01F85DD2BA3EE173061BFB02955231D9801362CAA729B8B15DB8EFA73391D8D3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\Music\kugou\kugou.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8086
                                                                                                                                                                                      Entropy (8bit):7.96318899322068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wakANE0zB4bPD3FX2Xa+AjGLf+ZBHq:W50wZAN7qr/jGLfCBHq
                                                                                                                                                                                      MD5:1752E6A102C825F40CAC0102CA4389D3
                                                                                                                                                                                      SHA1:FEA1008EE4EBC636C20AA6E78145802F498FA4BD
                                                                                                                                                                                      SHA-256:5A44CAEDAE5C4FBAAB8AF9FC71B320E2F85ACB879420DF4C4962D87226E8F7EC
                                                                                                                                                                                      SHA-512:C436B3AEE7107478C93ECDC8FAA941F43DD830CC492073803D9420D91B0C1C077B437423E2A013DC46D11A26A549EC2751E903882097A54FAD4E82542D1BF036
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\Music\kuwo\kuwo.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8115
                                                                                                                                                                                      Entropy (8bit):7.965265564609039
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4waeV8OpYHbC8iBo7IDEeENYwWLTzmakArjP:W50wj9u8qIDEeENYZHvZ7
                                                                                                                                                                                      MD5:440543B6F1CC1F444E6A5FE8E5247D09
                                                                                                                                                                                      SHA1:0C3E16121D76EFDE609E48C571D90F711F84AB9B
                                                                                                                                                                                      SHA-256:7EDDECC40D5206764122F3C5632DDA068FF6E20F8C2C043B3B596E9D69FF6507
                                                                                                                                                                                      SHA-512:3EC7D77984AD04FB16ECADD83F0295CCDC1CB762C2C5877DEEE25D5CB1F32139C306ADF7A6D7D706F694A3AB9FEBF0E4E8500E2D7E8F9DE27ECC915C18EA61CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\WallPaper.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\bak\Config.nxdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):290
                                                                                                                                                                                      Entropy (8bit):4.645472736563747
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:TMVBdxdaT0x3OY0FgU3OY00mxFxpyRdL1Li3OY9WhblIW5:TMHdxdaToYgUHmxPudpLisZIW
                                                                                                                                                                                      MD5:D4C64B72909AC4E1A9D967BAB4CBEBCE
                                                                                                                                                                                      SHA1:C9E6212F312A0084112B8E909EEF04C28FD3C81A
                                                                                                                                                                                      SHA-256:8ECCCE53B3E4F3A052D15C40391B883AEB5ED3B0F17750FC131D19A57EC6FDF0
                                                                                                                                                                                      SHA-512:E260F51650C704BB8869CE0D4739F00C4D9EA53E14F58678E7760F0B0F930E8584162CE3C1851E100C3C8376656B459ABA71E8204ED4AC362A80BE24A91DF0C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" ?>.<configs>. <SEG sn="SettingCenter">. <ITEM k="14" v="3" />. <ITEM k="15" v="3" />. </SEG>. <SEG sn="FavItems">. <ARRAY k="ItemArray">. </ARRAY>. <ITEM k="NoImport" v="1" />. </SEG>.</configs>............

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\app_stat.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\loginassis.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\extensions\LoginAssis\update.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Desktop\import.fg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):78
                                                                                                                                                                                      Entropy (8bit):4.367903661777143
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:L58BhYUyC2MYRAQHX5ov:uMUyCrYeQHX2v
                                                                                                                                                                                      MD5:6484C6AC89C6DD619A9B1E613C77E66D
                                                                                                                                                                                      SHA1:6462D4DCCA4ACC69CA0BF40C31AF4AF68F3BF29B
                                                                                                                                                                                      SHA-256:1FA27708E6D3FFAE9C1090ABDD4C3514C1233008A66D94568F3A3E9E559EC1EB
                                                                                                                                                                                      SHA-512:F5E4CB990E5F3BE1918BEB7056BA831C1C200E4D0B351224D28E4DAB23D3D279188573E3309F95333F25B56D4D701B7DE70FB2702558356055DD45230E8ED61F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[import]..version_opr=2..fullscreen=1..system=3..runpreview=1..shownewuser=1..

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4405112
                                                                                                                                                                                      Entropy (8bit):6.54104069780479
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:kZoX2uGyQPd38V3ScT44Q6SrRaVWiXk+NolDH8k1VbAxwhvcL5b+xal50+pTRT3q:WndPd38VCON0+rk1Vbm5bEA0+7qf
                                                                                                                                                                                      MD5:F1C9C0C1425BBCCF47C1AFB1302F59FF
                                                                                                                                                                                      SHA1:24A0CE9D29449164B50F7C8B6BB50F130762A467
                                                                                                                                                                                      SHA-256:073FD886ABC9132482C8B9B944473C08CEB8604187BBA3A5E4DAC0221C4C383C
                                                                                                                                                                                      SHA-512:CE7E415A3ECAB14F3747D51C9619700D65141E3349C5E56E937D0A16BB6FECF2FA5295B3ACA95AAF9AAA954877CB422C5BE8A955E3FD2D8171736BD050AAA332
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                      • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.exe, Author: Joe Security
                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...yn.P.................$8.........X38......@8...@...........................J.......D..........@....................<......p<..I....A.............."C.x...}.J...............................<......................................................text.....7.......7................. ..`.itext...(....8..*....7............. ..`.data........@8......(8.............@....bss..........9.......9..................idata...I...p<..J....9.............@....didata.......<.......9.............@....edata........<.......9.............@..@.tls..........<.......:..................rdata........<.......:.............@..@.reloc.. .....=.......:..................rsrc.........A.......:.............@..@QProtect.0....I..$....A............. ...................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360seNotify.rs

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):695672
                                                                                                                                                                                      Entropy (8bit):7.872174101935894
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:9iqXVf+i83kCL4fa4gfL4fa4gfyAb7QvzAuA1UmLpflEddb8b:kqXVl8nyAbUvMuA1UmBWD8b
                                                                                                                                                                                      MD5:AFCE1572F712D14924A54D6C6D85A253
                                                                                                                                                                                      SHA1:DC5D68D5F32CAF04F88875AA69AB3F0B62239513
                                                                                                                                                                                      SHA-256:A7D817E4CC497496E98CF1463A0E490ECB0DFB83BEB9E2B21A23DA911D75F699
                                                                                                                                                                                      SHA-512:25F611690B8133ACFEA262A902B76843AD0753599503D45232D02946ED0248A7CEE8A39C772853E512004AA93C3E657BF9D8B66D26BB36AD19011875DDBF7F4F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....ZP.................8...L.......P.......`....@..................................2...................................................:..............x...........................................................................................text....4.......6.................. ..`.itext.......P.......:.............. ..`.data........`.......<..............@....bss....|+...p.......D...................idata...............D..............@....reloc...............H..............@..B.rsrc....:.......:...N..............@..@....................................@..@................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\360weibo.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2473320
                                                                                                                                                                                      Entropy (8bit):7.170882557492812
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:JrUM+KjQptQubmeGTU9taTqvyG0F/n2umcetnHaR:JKtQkmGc2Rcv
                                                                                                                                                                                      MD5:207187DA1CFD94F8D927A6D6094A33AF
                                                                                                                                                                                      SHA1:2BBCD15B440101F5781DB5F5178CEF8C0232CE3C
                                                                                                                                                                                      SHA-256:BE964FA9736D7BDAD0C950FFF371197574A7081F488A884605C17010689CF877
                                                                                                                                                                                      SHA-512:E3F32CA9805AE7267C399DEDC784E6A76A1A282A686490D02A32FFD39A719EDB49A3E07F7079709140A1EF3A21042267266A2D1F971881AC514D142F69D646AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D).t.H.'.H.'.H.''..'.H.''..'.H.''..'+H.'.H.'.J.'.0-'.H.'.0;'.H.'.0<'.H.'..<'.H.'.02'KH.'..,'.H.'.H/'.H.'.0)'.H.'Rich.H.'........................PE..L....."Q..........................................@..........................0&.......&...@...........................................................%.h.....$.4...0...............................h...@.......................@....................text...P........................... ..`.rdata..fL.......N..................@..@.data........@...`...*..............@....share..............................@....rsrc...............................@..@.reloc...n....$..p...:$.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\ExtNetIncrement.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):285048
                                                                                                                                                                                      Entropy (8bit):6.492512091199515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:As8yZny7jGBbSLPdSP3JBI6jsR8Pym0OSahuJ+:zy7SBb+dSP3JBI6o8qm0O/EJ+
                                                                                                                                                                                      MD5:39E18F0F619546380688A92AF44D654B
                                                                                                                                                                                      SHA1:76D6E5065F188EA287D00BEB8B2C38C4F9631038
                                                                                                                                                                                      SHA-256:3C2FFF93C150BB229FF1B71E8720CC18DEB9B69B1A0FCBFBE691256EFF3DEE92
                                                                                                                                                                                      SHA-512:B53339E2C940A38020C48F3F9FD3925168CD7ABFB6B974A4E80FB4762FA8A9A028638FC0D904F4A8D0065F50C0CE9672CEC3D945C9B5146CC8D13B7C712C157D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$..VE.HVE.HVE.H_=WHLE.H_=AH.E.Hq..HAE.HVE.H.E.H_=FH>E.H_=PHWE.HH.VHWE.H_=SHWE.HRichVE.H........PE..L....#`P...........!.....T..................p...............................@......................................@.......T........................D..x........!...s.............................. ...@............p...............................text....R.......T.................. ..`.rdata.......p.......X..............@..@.data... ...........................@....rsrc...............................@..@.reloc..:D.......F..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\defaultskin.zip

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):89232
                                                                                                                                                                                      Entropy (8bit):7.804803823752292
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:y55kBo8le0jvUXLH7STim62VC1A58PblX1XzJxUn5ucRGcZRX4:y55kBoDeI/STBB2A0x1jJxu5VRGcZV4
                                                                                                                                                                                      MD5:0AB8A06150CBB0561E907976715CB447
                                                                                                                                                                                      SHA1:71ACEACA41CDB176D9E6CCE7856B44A3D39C573D
                                                                                                                                                                                      SHA-256:F160C8EFA5A2D1F42216403DB162BF0F205C716A5FB96522D1A573C28031191D
                                                                                                                                                                                      SHA-512:D5D787AAF97E764BB7EE226CE33EC765C308D27BC4FC4F18EE3A9A3BFD766E964D052BE854B1F418340E4657DB858AD5EA950DEB6C37A9FCDA70A3667E43CF8A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK...........A................default/PK...........A................default/add_link/PK.........aA...x............default/add_link/bk.png.T{8.{..Q3,M....Q.....!...}n-Ns'IL.$....g...!..en..Sn1+....4.5#.vv.8......}>.....}...&.,.$.%...B^3w...7..,.&.?[f...x:....~......].\.c..../U8`...[.6-.8%..q.9......C.#....yQ}......X.=.^.D.IIDT..s...(6u...t.!....l.......f....3..U.a.bq.Y...5....._Q..}b?.]....6sZ..++.^...F.........*V3....t.c./..?}R...9..H.<H1B ...'&..X.....G.U.Z_Jc.>.._.k&.$$$\v.\.g1.cOxe^......{-tF..@.1,[...D....,l......+p.J.r.]z.....sS,=..Z..`.^FCQ....&".........}..F4.....?..i.Z. .... 'E...s.....0.#...Q....(..........v.....F..e0<.T8p....q;.$\...L...u~.]x...4z/J%./.\_4..#Dz.?S...\.M.4@.O!9'....K.G.9zYZ...?.....-...O...i..Bah'..YvR..e n.;#C.K.pTck..{U.....7...j.;..4`%.....<........$D...".f.....2@q.Gh...3Y@.G.r...P.}...N..T>..F.i..).........<6..>z..U.QC.Lw].9....,.!l.y......k;{...w)s..\.]s/jD.f}.....3........'Hb.e.....W.Kp-T\...Z .s..?.KT.r.B....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\language\2052.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1592
                                                                                                                                                                                      Entropy (8bit):5.57984884030076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+jUY4lo0tGhjg4URnvJgCWaiJm1Nob6AdtT4si2OaaNoq26AdtuQyskB0uPTn0O:rjyosGhMhRnSCM6g472F6DMcvTn0O
                                                                                                                                                                                      MD5:A4CAC1232C683C6F12FE77D7F18E8982
                                                                                                                                                                                      SHA1:ABCB5A0E26260EEBC4A24753496358E0D6CC2BD2
                                                                                                                                                                                      SHA-256:F6D12D2742F2CAE90B9CC1EB2A51C81F793EAED9B6E3E18439F00EC74F1C7D9A
                                                                                                                                                                                      SHA-512:5DF6850EB4AE88F6C137FF33591DF74DBBF921C65A87A416031D5CBAA332217CEAEE45EEC7D7373A511D1BC80FD9E414DC87881C82576E82B654E98D72530443
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.a.p.p.].....N.A.M.E.=..mo`.vP[....L.A.N.G.U.A.G.E.=..{SO-N.e........[.M.A.I.N.].....1.=..`(u@..c0R............[.L.O.G.I.N.].....2.=..R}.-N..........3.=..f.e.e.l..c.N.g.RhV.....z.T..........[.B.U.D.D.Y._.L.I.S.T.].....1.=.._ZS}Y.S....2.=..b.vsQ.l........[.F.O.C.U.S._.L.I.S.T.].....1.=.@b.g.R.~....2.=....R}.-N................[.C.H.A.T.].....1.=..S...Q.[.N..:Nzz........[.W.E.I.B.O.].....3.=.#...(W....eQ.[IN...#.....2.0.=..b.v..u.....2.1.=..b.v._ZS....2.2.=.@..c0R.b.v....2.3.=.6e0R.v.......2.4.=..b.v6e.........[.M.A.I.N._.T.A.B.].....1.=.._ZS....2.=.@..b....3.=........4.=..y.O....6.=.sQ.l........[.I.D.D._.S.E.N.D._.R.E.C.O.M.M.E.N.D.].....1.=........2.=.l..S....6.=..S..1Y%....N...S.^..Y.v.Q.[....7.=..S.^1Y%......z.T.Q.....9.=..S.^.Q.[.N..:Nzz....1.0.=..Q.[*Y.....N.....1.4.0.*NW[&{....1.1.=.l..S._ZS........[.I.D.D._.S.E.N.D._.W.E.I.B.O.].....1.=..S.^.e._ZS....2.=..VGr....4.=..N/e.c.v.V.P<h._...N/e.cJ.P.G..0G.I.F..0P.N.G..VGr....5.=..N O.v.V.P._{..\.N5.M.b.....6.=..S..1Y%.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\_appdata_\360Notify\Bin\language\current.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):3.070031888400838
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Q+elPVtClLtlElQalGn:Q+elqlxeldGn
                                                                                                                                                                                      MD5:D45E9DDBE56A1DD7B58BD733BFE482B5
                                                                                                                                                                                      SHA1:2C83B4D3CB08F08D1C3545FF50AE14F0B49A58DB
                                                                                                                                                                                      SHA-256:52989F602299162773D8814D10C6A5A45FA86B4BDADF7295FFBA816AFE04CD32
                                                                                                                                                                                      SHA-512:D24A4D96458E103B51F5A23DE3528DBA1BA216692870B1E4B41625BB0D7EFBAAEA5B8BC2A90E6CE25C14408F2B90A0EADDEEF45356E1EDB07A964AC04818F87A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.a.p.p.].....l.a.n.g.u.a.g.e.=.2.0.5.2.....

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360Inst.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):894360
                                                                                                                                                                                      Entropy (8bit):6.50736456481616
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:AflY25rYtl8e37Hgtry9Aaf31szCm5sktTWOW:ao5rAtuz31s++TnW
                                                                                                                                                                                      MD5:7F485B9E043A2B95100E34D80F0AB72A
                                                                                                                                                                                      SHA1:6B1AD0635BCA33E1A68ECC0F8945DF34A03B8F6F
                                                                                                                                                                                      SHA-256:21A1ED802E6896AFC13692D4A66E48EF6C1C80C1EF91246703CC5529D3B21FD7
                                                                                                                                                                                      SHA-512:5C900E97606D3177A24C3DECB4338544B4E1CB4D454DF3B91DC6CDD6BF2B68725A587B0237101674447B813D689942481F83918F5378AB21B76449DACA330717
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........WW".69q.69q.69q&)3q.69q.*5q.69qM*7q.69q.)3q.69q.)2q.69q.)=q.69q..3q.69q..2q.69qM>fq.69q.>dq.69qM>dq.69q4. q.69q.68q"79q.9dq.69q..2q.69q.0?q.69qRich.69q................PE..L......M..........................................@.................................m...............................................@..............@...X............................................................................................text............................... ..`.rdata..............................@..@.data....=..........................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360TopbarASS.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):256872
                                                                                                                                                                                      Entropy (8bit):6.339631168221611
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:3Xb99IZWz+PsND5nraXUrKronKAQLU/3PnXWvobxuaL5RVapOnTgVAO:HTVC0YUzKAQLE/nXR4pnAO
                                                                                                                                                                                      MD5:DEC58427DAFCCF050DA9AC893E28407C
                                                                                                                                                                                      SHA1:402F223A05C6CA83E961DCDA7FAEB7EDE7A37AF5
                                                                                                                                                                                      SHA-256:F007E20E10ACC6BC15A5890961BC9D971D43BC004E685C6B32F7A2261C20A7EB
                                                                                                                                                                                      SHA-512:DAB9B0CF62E65B48FFB018DD37867ED02650F0ADC1800110845030404C421BDBFC58FC2711C306963FC5FBDFFE29E4B99F38F277E8CC601FF9267848FD9A5951
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o.f.o.f.o.f.H=..n.f.f..x.f.f..S.f.f....f.H=..|.f.o.g...f.f..k.f.q..n.f.f...n.f.Richo.f.........PE..L......Q.................h...l.......#............@..........................@............@..........................................@..`...............h........... ...................................@............................................text...1g.......h.................. ..`.rdata...b.......d...l..............@..@.data...|@..........................@....rsrc...`....@......................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\360wpappInstaller_zhuomian.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1746672
                                                                                                                                                                                      Entropy (8bit):7.994118615758001
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:49152:qQQgSWLXONX2QQIxDZcn/tAFKtJcMEhnmAr5ZS2VfP:qcverZ4BXcBm83S2VX
                                                                                                                                                                                      MD5:02C91D3BE856789E1711C37649F382CC
                                                                                                                                                                                      SHA1:6FE184CE5D2198CBB6CCFF37BCDE5F9950BF9ECE
                                                                                                                                                                                      SHA-256:26286D2C63A0DF39CDDEB780B626D807C92A0B071D9C313010F24692BD98E2A1
                                                                                                                                                                                      SHA-512:A2279790AC31A0DC625CE0390EA2F33C8AD1ED125F2862A46117EF94830FAB66A92D76B8F49F6B8284DB9F306E2F9B4835A728BE381FF6FE126D52228D02AA0E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................P......&/.......................................s...........G..........@................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....G.......H...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\GBInst.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1412584
                                                                                                                                                                                      Entropy (8bit):7.990098245004688
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:24576:XbduHjw+g0xZXPga+rRrh0C1hgptkWgq9UHluMqs5/JsB23egfPti:XbdGw+guZ7+xhrhEFgquHz/k2Ogf
                                                                                                                                                                                      MD5:32DC2FA6DB8B8809B12A8CAD215C69FD
                                                                                                                                                                                      SHA1:0C6232CDEE1976179AF0C0CD9CF7E7A07D1F4C42
                                                                                                                                                                                      SHA-256:1FE187BEE814736553B90DED2581060F2AC5A81950876CD9418CF352DD236FE9
                                                                                                                                                                                      SHA-512:10B9467BEB0D71C41BBD487CAA6714CBFE519CA767792E029D39CECEBD660CE16E4DB6833BFD8370EC5628CF83BEB6E5E31C5966997D192895C7485A335C9C4A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................0...............................................s...........E..........8s...............................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....E.......F...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\modules\SwitchBarCloud.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):494
                                                                                                                                                                                      Entropy (8bit):5.057595445515239
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:MMHdtMR6Ml9CLrsinqlmoik6Lr/WgsZLr/2sBqrr/JrsW7Im:JdtMR6i9mnkij/K/Xe/JEm
                                                                                                                                                                                      MD5:5A3EE026FF55F8DD65A26FBC186FD5DB
                                                                                                                                                                                      SHA1:EEF2D54C1A38091E8D61F9BF5B9F4715946D6EC2
                                                                                                                                                                                      SHA-256:86EC857FD7844036CABE640AB49F92784C9225463413FFE1B406F2FB80772372
                                                                                                                                                                                      SHA-512:376E27A5D2DCC391A5C85A51518BBFE2559B72107AB05D0068E04928247688887D56FBED60A19429001B4FC870FF5C6F8914464277E1EA6AFAD63DC3F83F3359
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<SwitchBar version="">..<Button Type="1" CmdID="1000" Enable="1" Visible="1" Image="topbar_fence_button.png" ImageCheck="topbar_fence1_button.png"/>. <Button Type="0" CmdID="1003" Enable="1" Visible="1" Image="topbar_cloud_button.png"/>. <Button Type="0" CmdID="1002" Enable="1" Visible="1" Image="topbar_wallpaper_button.png"/>. <Button Type="0" CmdID="1001" Enable="1" Visible="1" Image="topbar_shutdown_button.png"/>.</SwitchBar>.

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\safemon\urlproc.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):87456
                                                                                                                                                                                      Entropy (8bit):5.616444162790961
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:iBIUl8MFxhYIvPhYOccxJn8ep+rH4DsSbsIJsZLWpx4ZsbcPMtiLlo5k0nApWsO7:iqUlbhR9cA+zE1f4HMtykCFzTb0wCac
                                                                                                                                                                                      MD5:8CE736CAEE5625DF6D0699D5F1924887
                                                                                                                                                                                      SHA1:4D165E5D265FE185754A6D4555826FF8A61721E1
                                                                                                                                                                                      SHA-256:7C2CCB4129D2263EE40BF92855D5C0325A666B2A87D8661E8621B24BA49563AA
                                                                                                                                                                                      SHA-512:D934CD27BB7C1A08D94BEDAA20A73C184CDCBF20980EA823CB9A52583D138049B66F7D6086849C82A67873154B2A7017A962895C4E39FC66F47A99F2EB4A2870
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\2...SlB.SlB.SlBcO`B.SlB.ObB.SlBwLfB.SlBwLhB.SlB.ufB.SlBwLgB.SlB.[3B.SlB.puB.SlB.[1B.SlB.[1B.SlB.SmB.SlB.ugB.SlB.UjB.SlB.shB.SlBRich.SlB................PE..L....soM...........!...............................e.........................P..............................................@........0..(...........H@..X....@..l...0...................................................(............................text............................... ..`.rdata........... ..................@..@.data...T0.......0..................@....SHARE..0.... ......................@....rsrc...(....0....... ..............@..@.reloc..l....@.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\safemon\urlprocnet.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):136616
                                                                                                                                                                                      Entropy (8bit):6.32770736826905
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:V6TQZc+yVXGmXAdP3ubBxFY54fPj0RJfgxVR:QTQZcXWD+JY54Yfg3R
                                                                                                                                                                                      MD5:542ABB59D9A55F1B1A615042231FBCAA
                                                                                                                                                                                      SHA1:32025169D4AC25971E96DD59173CA585A776DC8E
                                                                                                                                                                                      SHA-256:52C344CA31F055D1C3B87FEE17262B84A1B329F14780A8CA62F8A5B4D0DB85E2
                                                                                                                                                                                      SHA-512:BB29081544453316FB173D37F17B61D6C37E186780A34BCCF90060BB12D67A9B54E7B886121B75183945B5D60BF00EE29205C2F39F17B9E10A9DCA699FF1BE31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..................z.....z.....z............................#....#.....................Rich...........PE..L....apM...........!.....p..........Q..............e................................?...............................................................P...X...........p...................................................d............................text...(o.......p.................. ..`.rdata...0.......@..................@..@.data...\........ ..................@....rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\update\{F6F6A611-BAE5-4482-A483-BBD9A761C2A2}.tmp\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\Program Files (x86)\360\360Desktop\updatecfg.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12216
                                                                                                                                                                                      Entropy (8bit):5.545762152540709
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:/UQRSd7LSaSwSlSiSQSGShSWSBSfSwlSwZSw4SPS4SZSjSQS2SwVGR2J5m2I3vFe:MQOXwRxlvFTzbyb8Y8lWJzuCeZJpbGt3
                                                                                                                                                                                      MD5:073C203AAD12D6C2E4B163160B1BE5E2
                                                                                                                                                                                      SHA1:E43505A1F174C8F6AE8405DBFE05B47FA8B6DB64
                                                                                                                                                                                      SHA-256:616AC4743FFE7182EDA0D35FC161DFA776AA4606698B7A7E65F61A58A73BDFBD
                                                                                                                                                                                      SHA-512:83F3AF095B26C9C4BFE3732688C6BA1FC955F08F4D006139057E57E6CCCA01336C5A0A704ED9E8A6F3F2177088B980E8DA2FC873827F4B8A00AA54ED41505E00
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[wallpaper-cm2.swf]..ver=2.6.0.1040..path=C:\Program Files (x86)\360\360Desktop\Bin\InnerWeb\wallpaper\wallpaper-cm2.swf..md5=C49D014473AA8C4265DF5F40E10582E1..[mhead.jpg]..ver=2.4.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\ProfilePages\mhead.jpg..md5=21F120093FDEFB193952E0ACE4066C25..[Skin.jpg]..ver=2.4.0.1020..path=C:\Program Files (x86)\360\360Desktop\Config\defaultskin\Skin.jpg..md5=5D1059252A64312D62181DAE70A16EDE..[wallpaper_ext.jpg]..ver=2.6.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext.jpg..md5=0ABD919C48DC87BA83894DE37F59168E..[wallpaper_ext_cm.jpg]..ver=2.6.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_cm.jpg..md5=C252183A655AC31D68FAC62B2EFBE9DA..[wallpaper_ext_disney.jpg]..ver=2.6.0.1020..path=C:\Program Files (x86)\360\360Desktop\Bin\skin\wallpaper_ext_disney.jpg..md5=4E590ABBCAF2E93A86D82967DB90C3D2..[CloseMenu_Icon_Hibernate_Topbar.png]..ver=2.6.0.1110..path=C:\Program Files (x86)\360\360Desktop\Bin\skin

                                                                                                                                                                                      C:\Program Files (x86)\360\wftest.tf

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                      Entropy (8bit):2.251629167387823
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:8n:8
                                                                                                                                                                                      MD5:3AA7C78EC045BB511EC50BF991638B28
                                                                                                                                                                                      SHA1:E9265690391AFF7EE47EDA9C89D6F8B501A16CB6
                                                                                                                                                                                      SHA-256:BA598786C53BD5C78477953754C66F2F21D0686DD4D98E0F21BE7C61C28454F4
                                                                                                                                                                                      SHA-512:093C9DBA24CB9303399C4DBD0799B250C64E8269B0D0CF57FD3E28BF2F9489567FE363ED18005D1EA665C0EBD9EB26E9A8220E4BFDE071F1D84C37391FB4E787
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:wftest

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360????\360????\360????.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu May 16 09:01:18 2013, mtime=Thu Dec 28 22:37:41 2023, atime=Thu May 16 09:01:18 2013, length=206000, window=hideshowminimized
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1311
                                                                                                                                                                                      Entropy (8bit):4.611005114671986
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:8m8asbyEcdOE1ItlVhByAzEGdBmYdBmUUm1brqygm:8m8asblcdOcIFRzJdsYdpH1yyg
                                                                                                                                                                                      MD5:9E6F2A3766A4F910CEA2606CC0AF1081
                                                                                                                                                                                      SHA1:9AE7ABF95EB4A44329B8DE52F1A32E0862F2D157
                                                                                                                                                                                      SHA-256:B31DD7BC73C915DC7EE6F1BD0D3DC9BA012FCF23A32BC1E5A923794C3E75A6FE
                                                                                                                                                                                      SHA-512:C63E2B19E30FE77880E002F4F8A62EFB88C85639EF672FEFA6BE09AAC0F0A68A49C41D8EE89E7A0EB0C42058C970A2DA6750314CB337121B4DFBE2C2B52DA23E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:L..................F.... ....$0O.R...[>..9...$0O.R...$......................!....P.O. .:i.....+00.../C:\.....................1......W`...PROGRA~2.........O.I.Wp.....................V......T..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W`...360.8......W`..W`...........................S..3.6.0.....^.1......W....360DES~1..F......W`..W...............................3.6.0.D.e.s.k.t.o.p.....J.1......W....Bin.8......Wb..W......J.......................%.B.i.n.....h.2..$...B*P .360TOP~1.EXE..L......B*P.W.......C.....................4..3.6.0.T.o.p.B.a.r...e.x.e.......f...............-.......e...........W..9.....C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe..I.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.\.3.6.0.T.o.p.B.a.r...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.........*................@Z|...K.J........

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360????\360????\??360????.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=1, Archive, ctime=Thu May 16 05:12:31 2013, mtime=Thu Dec 28 22:37:38 2023, atime=Thu May 16 05:12:31 2013, length=1146032, window=hideshowminimized
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2109
                                                                                                                                                                                      Entropy (8bit):3.4901476400377387
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:8mYblcdOcIAii3JddhNdj7ddhykdh4H1Oyg:8Slikh3hysh4HUy
                                                                                                                                                                                      MD5:4F49F44495424CB1EEF4BD68D1DDB8E0
                                                                                                                                                                                      SHA1:80D2BFC28A59DC39D6BD7047A10C78A78785E99E
                                                                                                                                                                                      SHA-256:4BA37F90A0369C3FB7BBC9EF86C8997AB8AC42CC2ECDCD8D3CF0BA297C8898D1
                                                                                                                                                                                      SHA-512:DD13FBBEE2C09683747E76EC22B777EFBDB50F5264856FC47D4820CC98158B54455937DA42F4AA9346006C3760489A57E8A93D6030C4E0E4AA91028E41A5B7C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:L..................F.@.. ....z1Y.Q.......9...z1Y.Q...|...........................P.O. .:i.....+00.../C:\.....................1......W`...PROGRA~2.........O.I.Wp.....................V......T..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W`...360.8......W`..W`...........................S..3.6.0.....^.1......W....360DES~1..F......W`..W...............................3.6.0.D.e.s.k.t.o.p.....h.2..|...B.1 .UNINST~1.EXE..L......B.1.W.......C.....................M..U.n.i.n.s.t.a.l.l...e.x.e.......b...............-.......a...........W..9.....C:\Program Files (x86)\360\360Desktop\Uninstall.exe..E.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.U.n.i.n.s.t.a.l.l...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.U.n.i.n.s.t.a.l.l...e.x.e.........%ProgramFiles%\360\360Des

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360????\360????\??360??????.url

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows 95 Internet shortcut text (URL=<http://zhuomian.360.cn>), ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                      Entropy (8bit):4.621115365169273
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:HRAbABGQYm/5bEMfn:HRYFVm/5bEw
                                                                                                                                                                                      MD5:88E53DE9C4AA586069BD33FBB8BB7DE9
                                                                                                                                                                                      SHA1:9A550ED0BC829B88A51024C5CE340DFBE2BFD8F5
                                                                                                                                                                                      SHA-256:9A970857EE0C2BBAA89C0DDCE46A9791B1FCBF0599518DBDD8C4A48A815471A2
                                                                                                                                                                                      SHA-512:979C74655B3CC6E6738694A4BB398C265164083674AEE11A77B43355E2439A3FA32B24AD6D1CB90192DD5DAA963CB0B0E4B16AB82497CB2AE7AF0F5C04E82E0F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[InternetShortcut]..URL=http://zhuomian.360.cn..

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_62339874224de82a9abd3a937b2fb56c25ae5117_f78a65ed_1b07d4a2-a4bd-45bc-8f3a-4db3727ed1d7\Report.wer

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                      Entropy (8bit):2.4143288879416422
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:r/C1fvfbaujwW8ohPERJ0mP/HzuiFfY4lO8k:r/YvfbaujUop+J7P/zuiFfY4lO8
                                                                                                                                                                                      MD5:66FCD00C42F531862B56F54C63DC570E
                                                                                                                                                                                      SHA1:1276EF902AFE4545A258AC5268B451AA33D50D2A
                                                                                                                                                                                      SHA-256:6A174DD0F98B986C7B3DE250CA6E325E003003E36F6C84BAC1948AC246C4ED13
                                                                                                                                                                                      SHA-512:4500984A3432330EC619C2B601623E7F2396A530C5F515AD3C5928AFBFD952111F146F693608398FC0A2D6DAB3086D1503A98431A9D334022DD8949478114DAF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.8.2.8.0.1.4.2.2.0.5.9.1.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.0.7.d.4.a.2.-.a.4.b.d.-.4.5.b.c.-.8.f.3.a.-.4.d.b.3.7.2.7.e.d.1.d.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.b.1.4.7.2.d.-.a.8.4.1.-.4.e.6.2.-.b.4.c.8.-.a.1.a.e.3.a.a.8.3.c.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.E.x.p.l.o.r.e.r...E.X.E.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.0.4.-.0.0.0.1.-.0.0.1.4.-.3.1.9.9.-.3.d.7.f.d.7.3.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.b.0.8.0.e.0.6.5.5.7.2.0.c.a.d.8.c.1.c.a.e.4.b.8.1.9.3.c.9.3.8.2.c.9.a.c.9.2.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.2././.1.2././.2.1.:.2.0.:.5.

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_dd5d7afc3acb40f4e777363425aedd5e74273_07ad8ade_bf2cd1c8-1f42-4869-ad42-3bc33e7ef28e\Report.wer

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                      Entropy (8bit):1.7604110642536832
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:se4C1fvfbaujdYFPwfEkR2zuiFfY4lO8k:D4AvfbaujyPwL2zuiFfY4lO8
                                                                                                                                                                                      MD5:69FB9E23224206E224BE5DCA6B5019A5
                                                                                                                                                                                      SHA1:DE1295A08B911B5CAB599BB5BBD417C9719CC76C
                                                                                                                                                                                      SHA-256:D2F7366FB2EB87804C612F6DF4303D6CE2296E3BE9D6B60FD67B43A2792A00F3
                                                                                                                                                                                      SHA-512:BF3A99A4CB8E915017D3EDAADD59DE32F18E726A35D57A75B076482F6EEA72A1A389A1EA532FC567FB7493AD44CC6B65FD67D55B5E98EF71FA9ECFDA74B837DA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.8.2.8.0.1.5.0.2.3.2.7.7.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.f.2.c.d.1.c.8.-.1.f.4.2.-.4.8.6.9.-.a.d.4.2.-.3.b.c.3.3.e.7.e.f.2.8.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.5.3.5.7.5.2.-.b.b.3.2.-.4.7.a.c.-.8.b.0.f.-.7.3.a.8.a.e.b.f.e.5.2.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.e.x.p.l.o.r.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.f.8.-.0.0.0.1.-.0.0.1.4.-.4.c.9.4.-.b.1.9.3.e.6.3.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.b.0.8.0.e.0.6.5.5.7.2.0.c.a.d.8.c.1.c.a.e.4.b.8.1.9.3.c.9.3.8.2.c.9.a.c.9.2.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.2././.1.2././.2.1.:.2.0.:.5.

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD26.tmp.dmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:Mini DuMP crash report, 17 streams, Thu Dec 28 23:35:43 2023, 0x1205a4 type
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1102570
                                                                                                                                                                                      Entropy (8bit):1.4845922983844062
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:jS+KfJaoEIiDiRVtZvLELWX6GfaeyyZGjoa8JvH:e++Ja3IMiHvLGlGfaeyQl
                                                                                                                                                                                      MD5:7ABB38045FA160C0EFF018FFE0EE70E3
                                                                                                                                                                                      SHA1:03F4F1D5A656F51F5E95463DA9EB8EBCED0371B3
                                                                                                                                                                                      SHA-256:9E880DFC4C97575F09BF695F814B8222760E7854B143A88352F82C08CE733873
                                                                                                                                                                                      SHA-512:79838E9828FCB4CF6127930F8BA3B0AB8E95359CA1FE5839AC1B09E2270C2CBAC12015D9F3ED612915D039BE2F3B7242D313CE8CE5772B7518AC0B34D724655A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MDMP..a..... .......O..e............T... ........r..........t...D...................d...............x.......8...........T...$....... ....9..........|...........h...........................................................................................eJ..............Lw......................T.............e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...............................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERD40D.tmp.WERInternalMetadata.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):10884
                                                                                                                                                                                      Entropy (8bit):3.7013850326746773
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:R6l7wVeJMADdzA6YSBMMOgmfq1Sprk89b/W/Tm4fzVm:R6lXJMuzA6YEMdgmfq12/GTm4fc
                                                                                                                                                                                      MD5:0F33F45B911BFB7C04CAEA7DEF875A04
                                                                                                                                                                                      SHA1:D7ED253744C20A1D97922721FCDFB1E2A75A9438
                                                                                                                                                                                      SHA-256:4A6D2863D3DC36D2AC0D678224A563012782EBB109D9EDAB48FCB89784E2B844
                                                                                                                                                                                      SHA-512:660F23D0455B2776ABF938B3256956064A924C4643A539A46FB00D2837E8C207690C43836067EC133B867BB2D5019CF756126A7D13B5F7813DD2FA9D86C08286
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.2.8.<./.P.i.

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERD44D.tmp.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4728
                                                                                                                                                                                      Entropy (8bit):4.465667689451397
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:cvIwWl8zs9Jg771I92ZWpW8VY7Ym8M4JYtqF9yq85XxLb9Q3jd:uIjfXI7to7VHJAyopba3jd
                                                                                                                                                                                      MD5:B4A2F245852CDACD58B95DDCBF184316
                                                                                                                                                                                      SHA1:2DF435212A44D2C5C6F3CD3D45542647C49F6E93
                                                                                                                                                                                      SHA-256:535A27347C56292C28C6D06367E9AEFB497A6E8C64CE6DF0CD1FB453A5CF2BC4
                                                                                                                                                                                      SHA-512:F75FB1612B6BCBD40BF9CED001791E6AAA5667D5AF25383374AA34FCEE97B3C6B34E87B718D6B6D8C7CA8136AA4CC9C9716C6E5287E35374D9221C15E331BD2E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="124718" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC86.tmp.dmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Thu Dec 28 23:35:50 2023, 0x1205a4 type
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):690982
                                                                                                                                                                                      Entropy (8bit):1.5609158738695388
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:7U7UEksZEticeH5xe9TmcxwZ3eFdv064Vw+X:7UQERZEE356m+064V
                                                                                                                                                                                      MD5:199E0F6A89FDEFEBA7773944A07F14A2
                                                                                                                                                                                      SHA1:75528889B7411616483BED21DD1CCA0A776BD937
                                                                                                                                                                                      SHA-256:4C3BDA60D1869D42EB67E677D53747545D50F641BC524BC826F5F9AB4A1B0863
                                                                                                                                                                                      SHA-512:4A38F286553BA50EAA49A91663C1B2A29F87D32C49FFF75FC02A77795B2A9C3C81F1289FC2318B55F4407541358392FA810278162C11F7B455B6EAFE4946FA20
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MDMP..a..... .......V..e.........................F..(.......$...4U..........(D..........`.......8...........T...........................XU..........DW..............................................................................eJ.......W......Lw......................T...........P..e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFD2.tmp.WERInternalMetadata.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8214
                                                                                                                                                                                      Entropy (8bit):3.7209579482096635
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:RSIU6o7wVetbc7A3Ytc1+w3gaM4U3q89bIc3h7DlQ7DlmmsgxDvfHd6am:R6l7wVeJIA3Yq1Spra89bz3xo7fHdRm
                                                                                                                                                                                      MD5:FBD6F2B1F4390ED5742C3F8956C1BF2B
                                                                                                                                                                                      SHA1:EFDC4B947BBF10F7EB5FFDE729BB966AAE55B448
                                                                                                                                                                                      SHA-256:C9D8E0CABED275E8C0F060CC041853644065952E5B46D16654E6D27A982C3D20
                                                                                                                                                                                      SHA-512:8405F7D4B02D4AD3592A5CE3C54DAAB0FE2FCB4D87DD4683E2CC2D91D6E7B5135858F8554174E87392780E989370927D765E81C59DBA8403CE133F22A1A92C03
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.7.8.4.<./.P.i.

                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERF002.tmp.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4729
                                                                                                                                                                                      Entropy (8bit):4.462782840302616
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:cvIwWl8zs9Jg771I92ZWpW8VYOYm8M4JYtqFMyq85Xx4b9Q39d:uIjfXI7to7V6JAvoaba39d
                                                                                                                                                                                      MD5:1BFBFBA3CF1AF8FED072C2B8002F5D8B
                                                                                                                                                                                      SHA1:31C2BE6D25971C8BA8D419DAFE18D0D045A42D87
                                                                                                                                                                                      SHA-256:B72FD8C3A3B0A77C7243232F7FB40BC553DBEF2F7F63A992917B5A6AF2444934
                                                                                                                                                                                      SHA-512:3A480B66C8BF6B6A047349BC55FB2D01AE8A1829C86A233A51F5C353C6CF5376DF927210B5F0D5DB896D6AD2BBF88369398A17393CE13EB33ABB53A34E6D9952
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="124718" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                      C:\Users\Public\Desktop\360????.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu May 16 09:01:18 2013, mtime=Thu Dec 28 22:37:37 2023, atime=Thu May 16 09:01:18 2013, length=206000, window=hideshowminimized
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1287
                                                                                                                                                                                      Entropy (8bit):4.628884715317704
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:8mxsbyEcdOE1ItlVhByAzESdBmYdBmUUm1brqygm:8mxsblcdOcIFRz9dsYdpH1yyg
                                                                                                                                                                                      MD5:B02540C2EA805880F864B8E2450D22E6
                                                                                                                                                                                      SHA1:B7202E4EDD8C65D9F98C5D2CC9FE0FA22586AC4C
                                                                                                                                                                                      SHA-256:4CA56275FF26CAD2780C00526DB97DFD5A4885041BEE6D88EAEBB52DC6382A0E
                                                                                                                                                                                      SHA-512:EB02F6DF9BB83B1068F445F212C1853F85ECC598D1F193AC3BC910983443752A4FBC22971879BEC138FBD9B49D932601D510984DEE7E8EFF6CC4241AFCFF0FEC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:L..................F.... ....$0O.R.......9...$0O.R...$......................!....P.O. .:i.....+00.../C:\.....................1......W`...PROGRA~2.........O.I.Wp.....................V......T..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W`...360.8......W`..W`...........................S..3.6.0.....^.1......W....360DES~1..F......W`..W...............................3.6.0.D.e.s.k.t.o.p.....J.1......W....Bin.8......Wb..W......J.......................%.B.i.n.....h.2..$...B*P .360TOP~1.EXE..L......B*P.W.......C.....................4..3.6.0.T.o.p.B.a.r...e.x.e.......f...............-.......e...........W..9.....C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe..=.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.\.3.6.0.T.o.p.B.a.r...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.........*................@Z|...K.J.........`.......X.......128757.

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\360P2SP.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):724600
                                                                                                                                                                                      Entropy (8bit):6.515371619339392
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:xnFslNsHuR4pg6uEBj/jRK5nYg2DNfMC+zFXTX94/wo9Tm5KO1f:5FslNsO6yft2JfMjzFXTt4V9To1f
                                                                                                                                                                                      MD5:640F33B0059ED6EB89AA5133263846D3
                                                                                                                                                                                      SHA1:F1BC1491BBF6DAEC1FB2B1AA3437BBA4C3D3D0BA
                                                                                                                                                                                      SHA-256:677C9F6A9DF66F0F086931AD46B28B4C94BFF7A28960B8E9970B84801D633AD8
                                                                                                                                                                                      SHA-512:14E3A419C0A75B3780903889A0D4921AB7487ECF53272C10042DB4D211D15C226A10CF8C25AA23E143EBFE77C15A7A9D6FAE3BD2F4EAA5A701295A8AA6405313
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^i..^i..^i..y..._i..v..Vi..@;..[i...&..[i..W...~i..y...Ci..^i..i..W....i..W...*i..W..._i..@;.._i..W..._i..Rich^i..........PE..L......P...........!.....v..........<Y..............................................-.....@.........................pX.......D..,....0..................x....@...S..`................................................................................text...,t.......v.................. ..`.rdata..B............z..............@..@.data...@....`...:...F..............@....rsrc........0......................@..@.reloc...q...@...r..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\360net.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):275288
                                                                                                                                                                                      Entropy (8bit):6.682710718683491
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:Xxn20OeU6F/uixt2soJiM3EbmaOCs8WgNeDuctl4dzNQvB2YEGw069uK309tM0Xi:XJRUih2sevZsNeaVzSvBbX6019taPE
                                                                                                                                                                                      MD5:E6FF763A4AC91232979560525E12E4C3
                                                                                                                                                                                      SHA1:366D43F4C049137114FE0D72F84547632A399DD4
                                                                                                                                                                                      SHA-256:250BBC73FECDA4023E52D0D07FB3B77889D4D20BBEA55C59304237F0A1D5F763
                                                                                                                                                                                      SHA-512:2DBD3ACEC39CF7559DD22DF8F2EB2B1B5AE31D65599E3327F7910F375F10A49B7E6AC0A714A1C8D492D33CEFCC8955D5BE6D3AF7BE71B3BA94E54B5AA1437EC9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<.....w.<...G...<...=.y.<......<.......<.......<.......<.Rich..<.........................PE..L...{..O...........!.....f..........;...............................................................................0...z...|........@..h...............X....P..H .................................H...@............................................text....d.......f.................. ..`.rdata...s.......t...j..............@..@.data....6..........................@....rsrc...h....@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\360verify.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\7z.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360GameBox.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1143104
                                                                                                                                                                                      Entropy (8bit):6.908541805805633
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:M7rMZ9VnpbFmR3Wjih7gK3FNhAuqtqo40gu9xZu9xZoPyL7:8rm9VnphmQihVhAuYqo0u9Xu9XNL7
                                                                                                                                                                                      MD5:8DD4CE4D5EEE031135A64117731F0187
                                                                                                                                                                                      SHA1:139CB0851FDFEF952BC80307F22B9132B941F64E
                                                                                                                                                                                      SHA-256:428A0546DCF68A9ACB6A2CDC6082168652E3D315493230D06C80102BD3D09B1E
                                                                                                                                                                                      SHA-512:1930E581329EEC9B64AE1949AE84563E3F247C7AFF5622ADDB289D1630FB3364BF295CD1D610207D6B5BBB5FCEEC951614AEC9CA8DA4687333BA706D96D9E757
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..6...e...e...e...e...e...e...e...eM..e!X.e...e!X.e...e...e...e...eP..e...e...e...e...eRich...e................PE..L.....Q.....................t....................@.................................e.....@....................................,....P...............R..@....0..........................................@...............(............................text...:........................... ..`.rdata..P...........................@..@.data............<..................@....rsrc........P......................@..@.reloc..T....0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360GbApp.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2015408
                                                                                                                                                                                      Entropy (8bit):6.301459019627537
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:fxHf82WTNblrzv1I3pF4HYvMFkzFqv+IFPpds07XTuG+W40oS7B7L9xZY00:fxE9I3H4YCdpz7DuGvoGB7L9XN0
                                                                                                                                                                                      MD5:F20C9B80E5D66E079E4350A1BA0F6295
                                                                                                                                                                                      SHA1:1379EE0823F1B3284611B20F079CC7679C5B4FCE
                                                                                                                                                                                      SHA-256:7764AABF7B2B1756980BEEB384A63106841188DC03A9EDDB79F8F2FE451B8757
                                                                                                                                                                                      SHA-512:8B8608B1B318CF63D86AD4CD66BEACE9A0F294E9F986694B9DEB8C7A3338EFA05F8A0714A9EF6CCAE1384DE0452B29C603421AC00ECB1A489D6EEFC0FB6077B8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V.........w.S......P......A......F.u....~.......~.............A.......O.N.....Q......T....Rich...................PE..L...v2vQ.................t..........R.............@.......................... .......5....@.....................................|....`..Dn..........................................................H#..@...............t............................text....r.......t.................. ..`.rdata...............x..............@..@.data...d........Z..................@....rsrc...Dn...`...p..................@..@.reloc..hK.......L...Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360Login.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1113016
                                                                                                                                                                                      Entropy (8bit):6.641503286094176
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:+uGlpBgDHNQqYIWG5fsuHycQExuZe1g1ZOjCtg3mWiH95t4ElF:+uGlp+hYIWewcQ7e1g1KCOmWo5t4ElF
                                                                                                                                                                                      MD5:4683D7FE36DA34D5C875615C63A780E7
                                                                                                                                                                                      SHA1:9B8E25F57E5F2593EE27A2623571D0838B61E59D
                                                                                                                                                                                      SHA-256:DECD4A9179E0532E02DA7283CFBEFD4F672899AE23F663F1CB40D41119A5FBEA
                                                                                                                                                                                      SHA-512:ADEBEA3659220F22708810F5CB23007EF731E67CCE3EA48D3DE267D9B2A5DE12B1C63120DF302E299CA4E43AF3024A4AAD6E433B4F2C8CDADD0E86759D0F218E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........txi...:...:...:.m.:...:.m.:...:.m.:...:..{:...:..m:...:...: ..:.m.:...:.m.:...:.G.:...:.m.:...:Rich...:........PE..L....~.Q...........!................\........ ...............................@............@.........................p...3...t...T............................p......p&..............................p...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hz.......B..................@....rsrc...............................@..@.reloc..Z....p......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\360NetUL.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):229360
                                                                                                                                                                                      Entropy (8bit):6.679890430785069
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:RF494g2HDCpxH/cmBYpDIhjISo9TBVLnW/Z:Rm9OCHfcmBQnSo9TG/Z
                                                                                                                                                                                      MD5:68A3D19BA62C6987E88CB2B7712B9592
                                                                                                                                                                                      SHA1:E9B1C288165D09F2B0833719F7626FB39F96D350
                                                                                                                                                                                      SHA-256:7893BB10C4291D70A48CDC3C65BDAE5D9DFE15DD3F84856CDA6A5A4E51EAAC09
                                                                                                                                                                                      SHA-512:9A84096D56FB0C99A70BE69361FDF5F1ABE4583CEE4CB51FF12EB474CADF3CBD961952C6E78425E544F145A1FE8104B4E044ACC71A03BB30BD1A9C655E413842
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)..H..H..H..0O..H..0Y..H......H......H..H.$H..0^..H..0H..H...N..H..0K..H.Rich.H.........................PE..L...B..P...........!.................@....................................................@..........................!......d........p..\............b..........(..................................8...@...............t............................text...m~.......................... ..`.rdata..\...........................@..@.data....1...0......................@....rsrc...\....p......................@..@.reloc...+.......,...6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\AppcenterDataGb.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):642920
                                                                                                                                                                                      Entropy (8bit):6.282990832147541
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:5qBB65rJHvhc5gWES4bpbDBCWSul20XW6+MSP95HiVNT3yUO5VZPIxT2AdhWXhlG:7rYUbpnBCWSGP2AWXh5569l
                                                                                                                                                                                      MD5:C9DCDAE63FC4BC3BED7298E7C6FB3D15
                                                                                                                                                                                      SHA1:F573C038E3E005172F475FD4EE805060926BA3CD
                                                                                                                                                                                      SHA-256:468A1EB791002CFC420EBF42DF8D9F07DD345B630584D30A74305EA0F0F62329
                                                                                                                                                                                      SHA-512:2AC67254AFB1F12C8723FC031B95E73F8F07F15E2781CDFBDB03EB0C5D78CEEA47A52AD8864E3B7A488E96EC13B926F20265CB811F04F6F51A45E9E9A1E1A060
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S..S..S..t...R..M.n.V...|.R..Z...I..Z.i....Z.n....t...\..S.....Z.`.~..Z.x.R..M.~.R..Z.{.R..RichS..................PE..L.....%Q...........!.....H...p..............`............................... ......-.....@.........................`........t..x.......................h.......tT...b......................H...........@............`..l............................text....G.......H.................. ..`.rdata..."...`...$...L..............@..@.data...8U.......4...p..............@....tls....I...........................@....rsrc................B..............@..@.reloc..Ds.......t...H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\DTCrashReport.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):253616
                                                                                                                                                                                      Entropy (8bit):6.269768372575183
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:Luf0V9jblulC9FT2saGG1VLErK2RaqOv+TBRjp3L:Hug9FT251Vz2cqOv+TdL
                                                                                                                                                                                      MD5:5DC6B9FBC85018A912A166C5B7C6515E
                                                                                                                                                                                      SHA1:51DE39B4CBAF5F704464EF43FD89099D96A540B4
                                                                                                                                                                                      SHA-256:BAF48D4858CF440C64A617EB6FB0DEC7FA821A7136DA9D89A2FDE43CF09EB95D
                                                                                                                                                                                      SHA-512:A4FB4EBD7E5DD00C3CDC86A0F11100623348E57218DC417D55F625FA0EDF144971E39B60A040684241F6F4FE13D68397AC8F47D251F677A1E3A51098A4235433
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xzq.xzq.xzq.q..lzq.q...zq.q...Ozq._...wzq.xzp..zq.q...fzq.f(.yzq.q..yzq.Richxzq.........PE..L....Y.Q.............................+.......0....@..........................0......@-....@.................................L........0..@............................2..................................@............0..<............................text...o........................... ..`.rdata..L....0......................@..@.data...@I.......,..................@....share....... ......................@....rsrc...@....0......................@..@.reloc...%.......&..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\GameBox.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):156848
                                                                                                                                                                                      Entropy (8bit):6.538614114866669
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:2c7Qonv+JBCrms558lMUVnUWxYAJ/Rtrpt2sytOSigKPiSj2eMsRw8e6ciPyyp5B:2G8Crms/8FnPBT7gxShAmwA5cgTx+
                                                                                                                                                                                      MD5:46D0C5A9F1DFAFB0B842BCB2A944B1C5
                                                                                                                                                                                      SHA1:233B8E2769625DD09A576035189D4CA3327E02A6
                                                                                                                                                                                      SHA-256:BF84D8270CC9C4100D8DD52CFF5DEDD30CEDFF723BE38929FA32400BE5D97D8D
                                                                                                                                                                                      SHA-512:E5026A954F575D4FB24109CAC306AC1D848EA62B16475CDC450D3CEFB4B93E1BC45559E99059F927FC2ADBCE7F95EA11BE2A45A7CCA2894C5AA6310F7355D855
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.&...u...u...u.yVu...u.y@u,..u.yGu...u..u...u..u...u...up..u.yIu...u.yQu...u.SWu...u.yRu...uRich...u................PE..L.....RQ...........!................................................................x+....@.............................I............`...............J.......p..4...................................p...@...............,............................text............................... ..`.rdata..YF.......H..................@..@.data...H?... ......................@....rsrc........`......................@..@.reloc...&...p...(..."..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\GameBoxCore.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1124528
                                                                                                                                                                                      Entropy (8bit):6.484809189310972
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:Dp6e4S9JuvOCZLmvTO33iFnzQkOMnNf1bt:8S2OOGOMNf1bt
                                                                                                                                                                                      MD5:5619853A5AC4F54323F54A949160EA52
                                                                                                                                                                                      SHA1:60D787F954C12A23AB17DDED9F91C6C4B0B22173
                                                                                                                                                                                      SHA-256:937EC6B0A8D5EFCA5E35F09A11BB6BDDA44FB4EFB9E0CBB9899BF67287820F3A
                                                                                                                                                                                      SHA-512:1607C6A9614F5D5809BBDBA801E9BD2111977AEAE2114B35FA3110E662ED158AA107D6B2732579F7F34D26424D9C52B3800F0A045787F84363B13C8787B6A876
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j...j...j...8?..j..e%-..j.......j....8.ej....?..j......j.......j...j..Ok....1..j....)..j...8/..j....*..j..Rich.j..........................PE..L...$PUQ...........!.....l...........................................................Y....@.............................t...4........p............................................................. e..@............................................text....j.......l.................. ..`.rdata...+.......,...p..............@..@.data...\........v..................@....rsrc........p......................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\GameCenter.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):324
                                                                                                                                                                                      Entropy (8bit):5.136652937602475
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:JiMVBd/jXMIWEoAvSsy9LHhIZL/4MpJWrbZiwibUQ5apAYxyy:MMHdb5S3syzM8MpJMidbd5auYxyy
                                                                                                                                                                                      MD5:FC963EBF1CA23700F99AF46B7893938E
                                                                                                                                                                                      SHA1:BE3C152C6785F9C9C3605E6BEDAC4EA9D54C4EC1
                                                                                                                                                                                      SHA-256:2938F3FBB7BF5A078C8629FD4F3D6019F05BCB4FF774CC5E58FD4DE1E5D4EBB0
                                                                                                                                                                                      SHA-512:C5BE98ACA5FCCBF7DF98FE32EF29675F62471091A4334762AF89CF75BABF4E05D159CACDB445421868B2645F202DD69113689E338FA4C8CDC9818F437F656425
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<gamecenter>...<tab select="mgfindgame" recentgames="100">....<item show="1" action="mgmygame" name="...." from="" url=""/>....<item show="1" action="mgfindgame" name="..." from="" url="http://static.apc.360.cn/cms/recommend_game_new.html"/>...</tab>..</gamecenter>..

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\MiniAppdata.xdb

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\NotifyDown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\SetupUtilDT.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):170344
                                                                                                                                                                                      Entropy (8bit):6.515376474233682
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:X8cE5RULjRoG6LVI4P7+lLdoL6qY0foiStJv5LULIebzLo:Xb0RUfaGiI4P7+lLKmswRPtlG/o
                                                                                                                                                                                      MD5:301A4BCA1A602AAD88C5E21AE2A8322A
                                                                                                                                                                                      SHA1:73AEAF28C654C8AE61BABD5681160783520F5963
                                                                                                                                                                                      SHA-256:977B181508CDE3EFFDE19A22B03127626AF6D96B6ED0B29B7AFB514B1646672E
                                                                                                                                                                                      SHA-512:0A00B9274485FC4CA8EBA9BA90161AEC950034804076C79E4DE7DF76E971FFF179349E4BF6F72EF4F53D357E2D5D19584B7322C9C8D2DD1DE55BF2F1FBE22209
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......eqz.!..L!..L!..L._.L ..L(h.L6..L(h.L...L(h.L...L..oL6..L!..L...L(h.L0..L?B.L ..L(h.L ..LRich!..L........PE..L...R;.Q............................=.............@.................................u`....@.................................LE..........................h...........................................H1..@...............<............................text............................... ..`.rdata...R.......T..................@..@.data....3...`.......D..............@....rsrc................Z..............@..@.reloc...$.......&...`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):100
                                                                                                                                                                                      Entropy (8bit):4.5887239462276
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:DPbys4LVo0Bg47QDnNKNJKby9LxaVoB411byn:fys4LVo0Bg4UTN1bQYVo6jyn
                                                                                                                                                                                      MD5:5A9EA5D17938B505DAB8374D23EF5F01
                                                                                                                                                                                      SHA1:6BECC0520BB9EFB4EDFC89C5E05666DB9DDAE6DB
                                                                                                                                                                                      SHA-256:B71BCA0A243BE9E174C54F04BB40F0BA4F093228089184D86F6C792DA85773EA
                                                                                                                                                                                      SHA-512:E4231D9862645115A55A254AD4FA0C45DAF6F3C1CD3E9E0E841A7B9FA3338F9B386EE5D9A279565A374D908F3940B9186B746E568D285B4B8C4F327F295A2034
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<uifeature>...<controldll>....<item path="UiFeature360Control.dll"/>...</controldll>..</uifeature>..

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature360Control.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):452272
                                                                                                                                                                                      Entropy (8bit):6.546876372610879
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:CIx7/JbPCSozzrRM96+V5/sXNsCyBq7FnBvSfSEBoeUICKZMeXGMIrqj5qrf:CIx7/8rnC96s/U97VBvS6EBgInmeXGMf
                                                                                                                                                                                      MD5:88DA47DCE2422F5CA1EA8CCAF94B0CD4
                                                                                                                                                                                      SHA1:EC6E45CBB75E468F421AE51378705A1177FB232D
                                                                                                                                                                                      SHA-256:C0443A671EE72A09FC18942D77A34EBA73A8FE7619144756C9AB019244F24FFE
                                                                                                                                                                                      SHA-512:631AD4A19B70D5F02E53D63134DE901C0565EBBC47DA3B9B9492A6C1A0548B7311411CBFD668CB5929C7D33D53A1893AA5D1EAE1DEFA0AEA1ECF51177DB1E489
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}t..............d.......d..}....d........w.......a..............d......d.......N.......d......Rich............................PE..L...GYRQ...........!.........................0............................... .......v....@.........................@G..\....7...................................G..@3..................................@............0...............................text...~........................... ..`.rdata.......0......................@..@.data....@...P...$...4..............@....rsrc................X..............@..@.reloc..pm.......n...^..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\UiFeatureKernel.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):339632
                                                                                                                                                                                      Entropy (8bit):6.596958488639138
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:bSMhbBN0RPgKmQs1wOWTxApJyL1l6niUG+VbNkrk908OI8a+gKeSjt5rPxrCmEaj:bSMhNWRPglwVTxAQ1l6niUG+Vb6rk90P
                                                                                                                                                                                      MD5:7BC5C0F13A513D3C14432C20DCBFBC6F
                                                                                                                                                                                      SHA1:086A8E486DC1816C07C2F59015BC7F61408C19BE
                                                                                                                                                                                      SHA-256:18E443B2582C0B04C92A3A9856F339AC8105AC5F31ACBFAADCA18E9FB74C08E0
                                                                                                                                                                                      SHA-512:F60CD9D94BD94B740379C0C9736E98048449793894633C13CE39EC4981476ABE9AE239663941844141B2171C30EED0CB350893A82C7B87ABC85C7F7098E3119E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.O.).O.).O.)...N.).F...X.).F.....).h.G.N.).F...y.).h.D.N.).h.R.^.).O.(..).F...{.).F...N.).Q...N.).F...N.).RichO.).........................PE..L.../wQQ...........!.........*......t........................................p.......0....@.........................p...[...l................................ ...+...................................r..@...............<............................text............................... ..`.rdata..............................@..@.data....;..........................@....rsrc...............................@..@.reloc..vA... ...B..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\img\body1.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1100x700, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):37228
                                                                                                                                                                                      Entropy (8bit):7.864517591610191
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:98CQQwNEIXSjdWY0bEhElF8KGi0PezfF9+E66EIb95q9OdSc5wbS:9Ju9Cj4lyI0Pst95XlZ5oxegS
                                                                                                                                                                                      MD5:14C615D8A20186FFAA9C0C037695A69F
                                                                                                                                                                                      SHA1:725C85D3C545B61FB7B3CA3D8D4463276D626B63
                                                                                                                                                                                      SHA-256:CC6519755C02EB71F584D4D2EB9E3E141650DE70C454080D273DA200128CB063
                                                                                                                                                                                      SHA-512:0FE07F2BE6C86F0309E0511AA102407962FE30063C437D500E7C7CCD4690707025AA9DE3E7D742A8228CD024FD885F64D979F04B7A63DCD9B342AD9A7A49395D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:381B4914B524E211A85B861A494E7F91" xmpMM:DocumentID="xmp.did:BE74084E31F211E2B2ABD4AE22098D51" xmpMM:InstanceID="xmp.iid:BE74084D31F211E2B2ABD4AE22098D51" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D01D3C733B39E211824A9B4353B6A557" stRef:documentID="uuid:381B4914B524E211A85B861A494E7F91"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\img\button.gif

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:GIF image data, version 89a, 126 x 148
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7268
                                                                                                                                                                                      Entropy (8bit):7.875018624996556
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:lenWc3xb/Xzke27c5B9LKpZRkeWmSZbZ1lxMdO1bGnlnSR1EnAYmG1pWar9b2/+M:lA3hXz950ZRFWmS1HlJ1bGntcEnzvVtM
                                                                                                                                                                                      MD5:510031EE61056900405C88FA1A2C8D00
                                                                                                                                                                                      SHA1:41EC7F17186C6B4930AC7628A042D61B1B3A9093
                                                                                                                                                                                      SHA-256:27C2CDB895B15A081D68E2AB39D1CB93A537BC7E5F88561C23923F533D63BA82
                                                                                                                                                                                      SHA-512:2CEE5CB9D4589AA3F3803187E63EFF8EE21A4C7A82E57CD5C972CD0AE5DB84359425173BC9A81FD8CF100D0DC6E2E1673EC4FBE3BC3CA12CBDF4F4FB82CCF9FE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:GIF89a~......c...................t.............z.........................................n.....................k........................a........}..........................................................W........................................................h......................................._..........x...............................................................m..n.....L...........i..........X.................l........M....l........K...........V..........................................................................U.....................................................................................................................................................................................B.................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\img\loading.gif

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 11
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1144
                                                                                                                                                                                      Entropy (8bit):6.7209258789405375
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:J/al1hpunQWwjx82lY2T3gVwxepyJ3Vy8MPmGY88a:GitNn2c6MoJ3IRPmL88a
                                                                                                                                                                                      MD5:8A86A85455E73B59849061023F0EDB9B
                                                                                                                                                                                      SHA1:DB960BF642FDA6F8DC2384102B122DE6E48CA915
                                                                                                                                                                                      SHA-256:748ED7E0D0852816314FFC631D8DEED8739CB2687E2ECA2CDCC414530A2CA6E2
                                                                                                                                                                                      SHA-512:113531E84D014EFE79D200981032CD148143FCDC1D9F2997EAC2EAA6C36ABB02FC87A7CBB65D4C38F0AEC45461FC7240E72D5FD8A4B99A437C258CAF1884468A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:GIF89a.......j..o..y..l..q..{..s..u..m..w..|.................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:DE32AF8831F211E2B2ABD4AE22098D51" xmpMM:DocumentID="xmp.did:DE32AF8931F211E2B2ABD4AE22098D51"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE32AF8631F211E2B2ABD4AE22098D51" stRef:documentID="xmp.did:DE32AF8731F211E2B2ABD4AE22098D51"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqp

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\installflash1.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2595
                                                                                                                                                                                      Entropy (8bit):5.764704709834132
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:t/lCq1FhTpK3I63vx7mrZI/IgYw/LIxI63vFj5idgBAI/Ic5KIW/I/iho+yCl+mk:1lV0I0qI/I2IxI09j5iI/Ic5KIW/I/ec
                                                                                                                                                                                      MD5:E9C0B699AF4A6D01A4F31F44537EE7C0
                                                                                                                                                                                      SHA1:FADA462FC70904FC8CAF2943DA5B216E74FF4FF5
                                                                                                                                                                                      SHA-256:B1710AF6E730D11A027A373F07BBA2E2C42CD70E4380A1E383E8CE5EFD230AFB
                                                                                                                                                                                      SHA-512:156E00C7C72D221AA871184FD8DE42E5137C73183EE057237F80B6AB9B0976AE0EF954D2507CDBDFA71961FAFCF46CA4B3E45A863C46FD57B5E06268E8A9A818
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="gbk" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style1.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..$(document).ready(function () {...$("#flashBtn").bind("click",function(){....installFlash();...});....});..function installFlash(){...window.external.wappFlashinstall(0);...$("#flashBtn").unbind("click").bind("click",function(){....cancelInstall();...}).addClass("btn-cancel");...$("#flashInfo").html("<h1>...........FlashPlayer..........</h1>");..}..function cancelInstall(){...window.external.wappFlashinstall(1);...$("#flashBtn").unbind("click").bind("click",function(){....installFlash();...}).removeClass("btn-cancel").addClass("btn-install");...var strHtml = '<h1>.......FlashPlayer......</h1><p class="f-w-n">.............FlashPlayer.................<p>';...$("#flashInfo").html(strHtml);..}..function reInstallFlash(){...window.external.w

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\FlashInstall\style1.css

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2187
                                                                                                                                                                                      Entropy (8bit):5.255911002184282
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZYGCveGXqPF+9jJ1exEU+vZYN96+g8HVACmFnRlxqNDUGXR6awzg:WJ1h+rGRV++MZWlrA9lxq5xBhwzefr8C
                                                                                                                                                                                      MD5:16FE8C6BD94A0A21217C0D960EF6F008
                                                                                                                                                                                      SHA1:B799CC35FDB97CDDBD854E8725D4AB1FC4FF4949
                                                                                                                                                                                      SHA-256:86C676627967C015B858ED8999F337BFA9547CF2A19AC5F1C3582D535C2A0065
                                                                                                                                                                                      SHA-512:D60311A8B541CCC5B010119C67E3B65D52EC25857CA9CD713355FC7B7F8D8FE4A8D3D8245FE93D7AE2D68787EFD4C33F9FB166BA236815FBFFC6FE17DCF230FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body1.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...blue{color:#1A8DCE;}...t-a-l{text-align:left;}...t-a-c{text-a

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\bg.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 682x370, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):34299
                                                                                                                                                                                      Entropy (8bit):7.886401642174046
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:49GOMIVwO5aeCKHpstGctFhM0IkE3ountxkOu3miS+PE2FA0ETeBm:4kIVNMoHpsgc7esS1noOuWi9E2K0Ef
                                                                                                                                                                                      MD5:B550092E07391F8185F571A9FA468123
                                                                                                                                                                                      SHA1:E46E480DBD44D633D9F3208D2082EF5996102B98
                                                                                                                                                                                      SHA-256:BC079E3B3307D409A37B511DB9DDA0BC7C37847A4D1D370B33B7926068D2EE19
                                                                                                                                                                                      SHA-512:375640C3656B7FCD1225DD5D15415642D1541B136A9190B83B32D8542B942BB0083AFDEB8A11AFD4DF81FEE09821990976866B17B2658DFCDE3B121D2C027536
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`.....XExif..MM.*.......1.........>Q...........Q...........Q...............Adobe ImageReady.....C....................................................................C.......................................................................r...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....p..-....R..P...as.......)..iw....)3.z...Aa@.T.J.b......Q.H.....R...{.......ri. w....o.._.c....@..U....2*;K...J.......(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorimg\btn.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PNG image data, 309 x 34, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2404
                                                                                                                                                                                      Entropy (8bit):7.496022879243684
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:NwqQNn2xpHKJ3KIeUSXdITUNneImrSui7DemFNeGPr5ls8vwIOd4yb3/n:7Y2XHBIeRdIYteIm2ukN15ls8vwI44+v
                                                                                                                                                                                      MD5:8FA7BA48B848A5562DF10C0784D33F88
                                                                                                                                                                                      SHA1:DFB3AF8DF29F93ECE124D080D91CDA8469D0E6DC
                                                                                                                                                                                      SHA-256:A52204F37C386320302A7A8955335169FBC882427447731CFF7E0B0BFD7192C0
                                                                                                                                                                                      SHA-512:8AB317BF932B6570C75961B25476887FE8DE537A3A1387E477854E0872CA8B169CE97DF0FA792CEAEA4430EA89C0DC7AEE20AA4383E96B8AF3CCE38385D6FCCB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...5..."......e......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:38058E3F653B11E29758D2EAFE369C32" xmpMM:DocumentID="xmp.did:38058E40653B11E29758D2EAFE369C32"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:38058E3D653B11E29758D2EAFE369C32" stRef:documentID="xmp.did:38058E3E653B11E29758D2EAFE369C32"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.s......PLTE..jj.Cd.?.....^..X..Y..Y.._..\r.?b.7h.;}.K..[.._..^y.H..Z..Zx.G..Y..Z..^l.>r.Co.@..a|.J.._..[..[..W.._..\..\

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorimg\t001.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PNG image data, 250 x 194, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7738
                                                                                                                                                                                      Entropy (8bit):7.909989373853702
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:gmOTV6GofBsXX3PT8bThjYhT/wK9cjWN5E1G:gmgVJofKXPT81GTYqAY
                                                                                                                                                                                      MD5:C55BBE3F95085359B6A23D7D651B0967
                                                                                                                                                                                      SHA1:70453F6CFB33E92336F5B80D3DF5B9443C0FDF17
                                                                                                                                                                                      SHA-256:FDF28877D6CEEEE8FA656DF1162D3F7DF4999E07423EA45AAC0B1A57F3E221B1
                                                                                                                                                                                      SHA-512:33F95B5881A5F9D2F2B37DC527FC467A53AD64A0ADCF922B2AB12E311C5372AE1C1D85EF35BF8A276AE5D32F347835E71ABBD14AC652F28113192901CBCE843B
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............W./.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0F7ADCE4653B11E2B353D0DA90A7D9E2" xmpMM:DocumentID="xmp.did:0F7ADCE5653B11E2B353D0DA90A7D9E2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0F7ADCE2653B11E2B353D0DA90A7D9E2" stRef:documentID="xmp.did:0F7ADCE3653B11E2B353D0DA90A7D9E2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>G"O.....PLTE..................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorimg\txt.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PNG image data, 294 x 60, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4366
                                                                                                                                                                                      Entropy (8bit):7.834486509641458
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:FY2gjTyweSnqLQNS4ewlZsqS3doIQyNQ6lPh/Ge1QQXsK:FYHy0qU5bZzIQyfh/r1QFK
                                                                                                                                                                                      MD5:540A2A3CB4331443977F78420261F362
                                                                                                                                                                                      SHA1:47FA9BAC4C575E8F1ADB0B568FC7F90E8FE6468E
                                                                                                                                                                                      SHA-256:586E93608F5A2F87274DAB6D1864AFEB30592D177C94030DBC05DBD7D871671B
                                                                                                                                                                                      SHA-512:2AE08DB067A0C939DE67404ABAAC05D7B115D82B81B7F48188C81467BB89C32BD39318CE09AE0ED09C218C20462EE821E31045D2E91BB3A8A274A0BAB17D75BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...&...<...... .....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:200AF0FD653B11E2947F934EBAB32ABE" xmpMM:DocumentID="xmp.did:200AF0FE653B11E2947F934EBAB32ABE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:200AF0FB653B11E2947F934EBAB32ABE" stRef:documentID="xmp.did:200AF0FC653B11E2947F934EBAB32ABE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.]V....`PLTE...U...............................e..............t..........................................:.c.....IDAT

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\errorpage.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1541
                                                                                                                                                                                      Entropy (8bit):5.521914842254377
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:tJJyE98h2ehVqc2cZsaEQF2mdwPFPza+7+NJGf:UE98h2e7D2cZsaEQF21W+7+NJQ
                                                                                                                                                                                      MD5:9C6137B11D28178BF2E369E05267D808
                                                                                                                                                                                      SHA1:76E470E1D91262734464D26E9D0EED634B14A89C
                                                                                                                                                                                      SHA-256:16523A645013AE034A997096F0019E735431F54C7C641601A9CDD7A63109BF40
                                                                                                                                                                                      SHA-512:6BA2A34C988FF085BB3D088B1F071FC525B0328F122CB04D4AC9A4487A5F7124496984FED9D60BABEE9A1BB1144C674283FB4B216BD9A4DEE2D31B55034593FD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />..<meta name="Keywords" content="404" />..<meta name="Description" content="404" />..<title>404</title>..<style>..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0;}..body,button,input,textarea{font:12px/1.5 Tahoma,Helvetica,Arial,'....',sans-serif;}..fieldset,img{border:0;vertical-align:top;}...w404{ width:555px; margin:147px auto 0;}...w404 dl{ clear:both;}...w404 dt{ float:left; width:250px;}...w404 dd{ float:right; width:294px; padding:37px 0 0 0;}...w404 .btn{ display:inline-block; width:103px; height:34px; text-align:center; line-height:32px; color:#fff; background:url(errorimg/btn.png) no-repeat; text-decoration:none; font-size:14px; font-family:Microsoft YaHei; margin:23px 0 0 5px;}...w404 .btnhov{ background-position:-103px 0;}...w404 .btnclk{ background-position:-206px 0;}..</style>..</head>..<body>..<div clas

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\img\body.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1300x900, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):44512
                                                                                                                                                                                      Entropy (8bit):7.4966322244558405
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:ZUegN/65ApY1kMvGuRIqOwJw+L4yWn1EOWLHSNkGfhqe/byvgMaCdnxRZQPIxTWX:ZUegN/gAakBsIqOwJDUyI1EOWLRGJDWc
                                                                                                                                                                                      MD5:2920FB149DDDCE84FE9D62336259CC72
                                                                                                                                                                                      SHA1:53989CA3ABC1B56AD8F6CFEA3216141FB1DD8171
                                                                                                                                                                                      SHA-256:5221116B3F0D8B02C93045510B91A66412E0D8FD998156CD10E055E70A2E105D
                                                                                                                                                                                      SHA-512:03B74CF361017DAEC1DF6EC5A490A9CA586C2259F8EB9401F8F1417546AC5F82373530134EC96D57333AD2E995B516F939941FC89B703DE83792B1E5739246FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......Exif..II*.................Ducky.......<.....ehttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="DCE0E11121C3596AF96F3EAEDBAF4DAC" xmpMM:DocumentID="xmp.did:92100F1F28D211E2B979A4EFB5CC2C9E" xmpMM:InstanceID="xmp.iid:92100F1E28D211E2B979A4EFB5CC2C9E" xmp:CreatorTool="Adobe Photoshop CS6 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:461E920728D211E2AD1D95A99DEA1E06" stRef:documentID="xmp.did:461E920828D211E2AD1D95A99DEA1E06"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.......................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\img\loading.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PNG image data, 420 x 18, 8-bit colormap, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1909
                                                                                                                                                                                      Entropy (8bit):7.234982063350527
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:PCCRgnxwhC+1SOLzA5+MTFC+M/BA6AlIxrYzI:KoyS8Og5rTA+BlCrYU
                                                                                                                                                                                      MD5:9DA3F1D059FECE8DDB1F6EDF43AC2363
                                                                                                                                                                                      SHA1:DB62DC742686C128F461938287DA27E4C522B1BF
                                                                                                                                                                                      SHA-256:E923BC0678176F9847AAFF4AC59E9F7C39780469BA29F6BAA481BA99312EF7AC
                                                                                                                                                                                      SHA-512:AA0DD1E1677D37386FD998676747D445D62DA8DF8A05B01A62FA5FE8D895EB428C473499C043957497AE7CAB63D6524A93B18ABDB900813355DD13D484BFC6F2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.............#vZ.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEp.....t..............l..|..c..L..Z.....R..E..J..z..i..G..r..`....Q...S..Y..V..O..T..d.....M....ou.._..f..a.....G..{..{.....b........L..H..b..R..M..N..W..S..p..Z..l..t.......aZ..a..Q.....X..N..M....#M..s....mk..Y..i.....a..Y.......iZ..k.....r..R..V..s..s..o..Y..s..j.....s..z..S..c....t..X...H.......YS..F..^..I.....S..c..P..T..H..[.....w..R..P..L.....|..K..H..K..M..M..Z....hN.....l..]..R.....Z..R..S..S.....L..../Z..m..r..s..I....qL..N..a..Y....6R..r..Z....+{.....W..j....{O..l..^..`..|..g..M..j....JK.....W..v..t..d..O..J.......E...)i.h.._..L..p..J.....t..$j.`..b..f..L..^..e.v..6-p.[..a..:w.F.4a..,r.'n...26}.>.m$k......g~..]..6|.@.o..QR.3j..J....Zd..U.1%l.e..k....*2u.F..x..-s.M..G.%.....(...3.lc..'o......=..T..x..3t...t_.....|:F.....tRNS..................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\installflash.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:HTML document, ISO-8859 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2482
                                                                                                                                                                                      Entropy (8bit):5.590226779905185
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:0WJGLApWCYSHpyvCgJdJu2jAyigWhicOhUvVUivtvCHe/LVMBq5k7S5p:OLwWl2icyiHicOaichMw5v
                                                                                                                                                                                      MD5:A02651F395EC9C2C9CB2AFBA857C36F6
                                                                                                                                                                                      SHA1:1FD54A1BCB9863FA98D87A3BE780309D30DD4FBF
                                                                                                                                                                                      SHA-256:9E6A4DEB3B08CC1859E881A90C95305CF921DC408342FDB6D626A47DD76EC4F3
                                                                                                                                                                                      SHA-512:47B1B47120C2457E921E61FF6B06FFDEC44C1789395240377FD48A2A2E5AA60769B1E8B6E6751EDFFDE6B79C89F82E3A15B771D8844A87E126D99AB7C25B2427
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!doctype html>..<html>..<head>..<meta http-equiv="Content-Type" content="text/html;charset=gb2312">..<title>Install Flash Player Page</title>..<style type="text/css">.. ..body{ ..margin:0px;..text-align:center;..vertical-align:middle;..background-color:#ffffe1;..}..div{....margin:0px auto;..}..div span{..font-size:24px;..font-family:"...";..font-weight:bold; ..}..div #tipstext{..font-size:14px;..font-family:"...";..font-weight:bold; ..}....div input, #installing{..font-size:12px;..font-family:"....";..}..-->..</style>..<script type="text/javascript">...function setTitle(title)...{....var sp = document.getElementById("apptitle");....sp.innerText = title;...}.....function installSuccess(success)...{....var txt = document.getElementById("installing");....if (success)....{.....if (txt)..... txt.innerText = "......!";....}....else....{.....if (txt)..... txt.innerText = "......!";....}...}.....function netError()...{....var txt = document.getElementById("installing");......if

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\intalltempapp.html

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):519
                                                                                                                                                                                      Entropy (8bit):5.160278137718593
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:hPgGxC7/mjWsVnqJmxTTqK5eQE8OYMCcfxqc2OAqUKCGb:hPrC1sV8IfvEYMCo9z
                                                                                                                                                                                      MD5:B00593D03F76B157C02A72A9F132405A
                                                                                                                                                                                      SHA1:FCE91F62543C4104BB906F3A83F6DEB7DEC0F5BB
                                                                                                                                                                                      SHA-256:825D1318B7463FD5F670958C5E7BEC7D609340661EAD84ABB4F2E68FF987498B
                                                                                                                                                                                      SHA-512:A33793891F05D7610FAD9D5B6F1EBCB4799871BE6F00C964E1390F36421085DC04DD1AE2C7BBB219FABBAB2FA94EAB2E923B491C81871A06EEA33EB639CBF2C7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<title>Loading</title>..<link type="text/css" rel="stylesheet" href="style.css" />..<script src="http://s0.qhimg.com/lib/jquery/171.js"></script> ..<script type="text/javascript">..function changeProgress(value){...$(".in").css("width",value+"%");...$(".percent").html(value+"%");..}..</script>..</head>....<body>....<div class="box">...<div class="loading"><div class="in" style="width:0%;"></div></div>...<p class="percent">0%</p>..</div>....</body>..</html>

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\apppages\style.css

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1657
                                                                                                                                                                                      Entropy (8bit):5.247663084618733
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:WR/ovNY1si+EZICveGXqPF+9jJ1exEU+vZYNo+g8HVACmFnRlxnMXUbF:WJ1h+/RV++MZMrA9lxnMXaF
                                                                                                                                                                                      MD5:7E0FB59D3AF2D442F44A939362311DD0
                                                                                                                                                                                      SHA1:3F1FD2C2B9DDC773B6972F767BD321F353C6066F
                                                                                                                                                                                      SHA-256:DF9459349CCB55416078BA535A17AE8587BF321049F4D0A5AF460879B62B4699
                                                                                                                                                                                      SHA-512:03D0D5D69C38A7E1F75D39A31E9C597B862F9D1BEDFA14C4CB8FD37EFE5800FF01F97A917A8ABDE8C33E98A87436101D183250D101E5BB85B1686A1F3B3B7935
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:@charset "utf-8";..../*common*/..html, body, div, h1, h2, h3, h4, h5, h6, ul, ol, li, dl, dt, dd, p, blockquote, pre, form, input, textarea, fieldset, table, th, td{margin:0;padding:0;}..html{height:100%;}..body, button, input, select, textarea{font:12px/1.5 "..", sans-serif;}..body{background:url(img/body.jpg) no-repeat 50% 50% #fff;color:#000;}..ul, ol{list-style:none;}..img{border:none;vertical-align:top;}..:focus{outline:0;}..../*float*/...f-l{float:left;}...f-r{float:right;}...c-b{clear:both;}...clear{clear:both;height:0;font-size:0;overflow:hidden;}...clearfix:after{content:"\0020";display:block;height:0;clear:both;visibility:hidden;}...clearfix{clear:both;zoom:1;}...v-a-m{vertical-align:middle;}..../*font*/..h1{font-size:18px;}..h2{font-size:16px;}..h3{font-size:14px;}..h4, h5, h6{font-size:100%;}...f-w-b{font-weight:bold;}...f-w-n{font-weight:normal;}...black{color:#000;}...red{color:#f00;}...gray{color:#999;}...t-a-l{text-align:left;}...t-a-c{text-align:center;}...t-a-r{te

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\img_reader.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):203608
                                                                                                                                                                                      Entropy (8bit):6.832543174324689
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:CxIYp86FpmNh/ZBypa4ZunTBfHFy6Ag0Fug795fz8:e86As2nTBvFy6AOIvo
                                                                                                                                                                                      MD5:D3A9CA700C1C65D6DF7E010B0CB0E3F4
                                                                                                                                                                                      SHA1:8E35CFC937B783808DA98376B5ED6163BD77148A
                                                                                                                                                                                      SHA-256:CC4D278AB85A0CEF68EF29FDBF723830C4F2BCC78B5B315F1530674059BCF0CE
                                                                                                                                                                                      SHA-512:8102BFEC316B89BF100350607491942332E881AA80981AEAEF8F607CAD5A4661B8E07BD9FE74506D8D775A56FACE181CF342074668338D42A3250A041AED4269
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l...............u{...................uj.....um.0....u|......_z......u......Rich............PE..L....HdN...........!.................6....... ...............................P......x0..............................P...K.......<.... ..................X....0..........................................@............ ..,............................text............................... ..`.rdata....... ......................@..@.data....3..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\oauthlogin.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):343680
                                                                                                                                                                                      Entropy (8bit):6.438296507662578
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:Od5qu1VG/cPM45zTHtcpBBzCXkLDLdfewus5qdr2ZdS1ltQp6:Odgu1VG/cPM4uBzCXkPLkwuwiu6
                                                                                                                                                                                      MD5:A1ECB29EC8237F21ABD334830573EC34
                                                                                                                                                                                      SHA1:DAD2D8F5976A018F3A5FE95C7DA5D8744971D5F8
                                                                                                                                                                                      SHA-256:AB07B5413EB43D56151EA1B072945A3FC0C075BF108AE9977EDB46B7D102E9E9
                                                                                                                                                                                      SHA-512:EABF128304CAB9540556984C43EFCA678897CA9DA07D5949C698156A6C38E8A23D037E98B7138D1930C33403185BDAACC842C79EFBA20FBEBB1379C437A2DEEB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tF..'F..'F..'O.3'W..'O.%'+..'aV.'A..'aV.'I..'F..'...'O."'|..'X.2'G..'O.7'G..'RichF..'................PE..L....NuP.....................t....................@..........................`.......>....@................................. m...........\...........(.......0...+...................................<..@...............|............................text...Q........................... ..`.rdata..J...........................@..@.data....E.......(...t..............@....rsrc....\.......^..................@..@.reloc..B,...0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\360GameBox.ufd

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):572982
                                                                                                                                                                                      Entropy (8bit):7.993988525472661
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:12288:afcKHBaJAwO7jNpFpybbBzSC2t9rc+dq1FAfpSX6WP1Vu:oFHUSzFiBMfc+w7AfpSXXu
                                                                                                                                                                                      MD5:0B62D44B3760E9C3A723CBC9CA8D28DC
                                                                                                                                                                                      SHA1:461437901D10AA37F0B1DEC2D8B2EF9B56BAE1AF
                                                                                                                                                                                      SHA-256:C4C3F29CC6830A37C7E5FFCFD44E72F98EC713D46CF355F0F556FFBE25B62C05
                                                                                                                                                                                      SHA-512:C43FFCA76663AB255A8922511BED7CA77870619D28A292A76A2CC484067A18F7939C1B0381BD4A4726B1F7ABD0B16EEAF8BB7CF06BAFDA433D7307EDDB63B0F8
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:P......1.62.tips_1.png.........PNG........IHDR...~...K.......3.....tEXtSoftware.Adobe ImageReadyq.e<...zIDATx..]KO.A..y..>X..(.. .=)\<y..<I.Q......OF...7...41._.11F@@X`w....{.....b....A..Y........X.1......0.-#...5.A.V..P...q.3<H.. ........O....e.b@.B.m.*......[VX#..F....q..R.My......~....40....Lq....J....... \...@.>.{.W..i3....j#......R..G.tg....5.!pke..S....a..U*...]go7.....sO.i...Y.^.........#...Y...5..3. 7.......dl.}}).~!2?&>.IY..W.....G...&.....{.V.j.vL.[68. 8.h.y;..W~....u/..v...../8.....%.).i...X.`aa...zh?~...........l.R....8R.....gL.K.K.gaqy....+..8...I.%....r.N]}..\wh=.`}....#.........v*...s...C.p.FxM.`...c.U...wh.J..B..B..}'.+C<^....h5.6.G...>XY.......I..+.l.(A<J..@...{W....y.,...i.%.%^8.P..z.....&.b.,.F."....(k<...O8..O......O..@}.......X...k..%...|'.M.z.{....}C>A.Xp..S..[.I.I.[.R.k...I.h#Gg.O.IC..:.Q;oD.O.z...........(4.)=.s4.1.z..9z...q....>b...(H...O..y.~.R.(i.\.MW.....S3.%..:h....E...x3.gmv.{.I....>.......O]..]=E..._.

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\ACCore_DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):91892
                                                                                                                                                                                      Entropy (8bit):7.7211777204809495
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:h1m3tWKbIHjtMj5xazZ1nShXVLvA8RmRT0E5OH+dIXif9Cb9x35M4:mJICObS1FbRmdn5EPifgZ
                                                                                                                                                                                      MD5:3699D25037F7554851F437867C0B8EAF
                                                                                                                                                                                      SHA1:82A0E395B04EA8B827D344A79D8A6BA57AF6AD3C
                                                                                                                                                                                      SHA-256:062992FFFE11B3DE94C872E948EF8C4FFB21F394287C0275E133E9EA1BF7236B
                                                                                                                                                                                      SHA-512:FEAC6CAA49917D6E42920DA707E0085D587A0571516FBD341A56F0B32F3A27EBE2FFA1A5E38FA6CCA3D1EF52420FB39B917803BC2BCA0CF6AAB2876CBACE75C0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........rX)B................dlg/PK..........(B................dlg/bkg1.png.PNG........IHDR... ...g.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...j.A......^..Y....N%.I.......E....g...B.T.Z.Bb....`!..g...3E..w....s.....fC......RZ.....9Q....G....UZ.....bZ.7.].].0.b..hC.......[....&@.V............C....=}..~......0J.Qi..Z.f..6......6.>..6....y..P(....8..8@U...r.....u.....QNL@E. ..TLL@.`@G.Pi..r....4... ..,:...p.k.....dR....!"....M@@F...L......i..(...2...........:.Pm........ .....`@N.O.B.}=..&.p..&@@7G..|.*...v.......L@.4L@...9.{..A@'G....tP w.@wG1[... @.......... @..... @.......... @..... @..... @.......... @..... @................. @..... @.......... @..... @..... @.......... @..... @.......... @@....s.g'.l...........N....kZ.,5'Y....G.......7.....C@+F{.../..O_..;qiu..}?.{i-.u.6.-.............N.u.k.....IEND.B`.PK........;N.A..L.{...{.......dlg/bkg_new.png.PNG........IHDR...H.........Y..Z....gAMA......a.....PLTE;..;..;..;..;..;..7}.:..;..:..7}.;..9..9.....;

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\DefaultSkin.uiz

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):267679
                                                                                                                                                                                      Entropy (8bit):7.78195970613591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:otpcuZ3r3EtnnJCHgrypGJvMnL7kQNFJpz8tXI0:ocUAnn8HzgJvME8zj0
                                                                                                                                                                                      MD5:980AC2C5489BC3B878BCA46986692D44
                                                                                                                                                                                      SHA1:49B9AF34D456BE6FCC1C8FD19F87B7F71A2BA1B5
                                                                                                                                                                                      SHA-256:8488F435B2D25B715324353EEB70FF8C616A99ED15EC8B853B0BCC5A65874277
                                                                                                                                                                                      SHA-512:98358D54D42F29D4846CBCB291A7084CA9BA32F253920CDF637CE833E753A171912F1095039CC09D5A89696D0BB839510EFF4D154EFF087E5EACF9E2F835B2D5
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK.........RaA................360Desktop/PK........Qn'B................360Desktop/Image/PK.........\.A................360Desktop/Image/Menu/PK.........RaA.v..%...%...(...360Desktop/Image/Menu/Menu_Icon_Copy.png.PNG........IHDR...&.................IDATx^..k.A......J#$....@.z..C..."..G.(.I.B....E.....z....B...j..].0..&...M......a.7.._.1....g..w6..=.1t...i..m;.4....`.fDC.......u..-.Deee%Aiy.K..."_.v.8N.0.s.D......'...E.*.....?r-UC-.^.Q.......y..I.X<......\....Z...[..J.U.Tc.b.I.R.(.yp.......p8|-..u3.SK.L&S.8.Nr...........y....?.../.....h...<+.JoP..(G.2'..t:ksss......g.5::z.o.1..=.1.....1..x...R0.shh..J.`..0..~..$-&6..lI.k0u..|.H.!.q`.d...L2..j5..r..M40.#..R...l.^...V.3......2.&rN+....M....C.juF.P1.NS.6............,.".=T).......cz..u]..d8D.Y._D...fs.......I.1....iLl`..r./..Eu.......A..t.Ab..v70.9(..lW..#.^......]ZZ:F|O.L&3.....%....ip../...4....|........t.7..}h.....%n..J...<m...;.......M.\.g....3.F.w0>........m....l....6`;._.Zk..f..@.fwAK...:.Gh1...-..........3.

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\GuideBalloon\LoginGuide.png

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PNG image data, 183 x 73, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5956
                                                                                                                                                                                      Entropy (8bit):7.9594836492593295
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:QbK+ZJ2vCF4s9VTictWZY5Am6oxbBJz/AAi2lrVLR4IPatv33ToS5Kdv6rfIp1:bQImxVmzZY5AfoxbrzYWpVLRch800vWe
                                                                                                                                                                                      MD5:5EC40557CCB2E9A39879EA799018EB26
                                                                                                                                                                                      SHA1:82FC6D094606514841DFB5AB864B846C5A5A46F5
                                                                                                                                                                                      SHA-256:EB25D78399475BA7BA0BAC83C90221759BEFBA256A55A5245BBED1C74E3140E3
                                                                                                                                                                                      SHA-512:E5C6452B7A8E43DB52776BE09C8DA4AD1E6613FC3883F18FCB1B57643714C8D2BED45C553FFD3BD6EB95A6C0795294024355CB2C17E8D55BD6F012D7CE7B4D2A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR.......I.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..].X...l.............E..E.V..[.......W.......h.....j..j..W[..Vq.\X..E! $!{23w.I&$1......0.Lf9s..{..~.9g..$...Z[..2X/....p.%.|d+.....6.6.t..Q.(o.......C6|...\..YkC`sK~..(8l}h.|.......`?..,s....].k._...K..3.|..X.:R...U+V....u..O.g..Z..{....Y.../......<.~.7.2.R_|.O....h.%....g...V.6..OGH..B.I{e=$..."........b..9<..S....I.Q.i..p..Yk5....HY..I..}...\.4{.(..]?G...>s.zV...VS.$Xp.v....q.H%A.I....d.9.i..b>..*"U.....5..7uO.r...;..L1....ZK.].u.h.4.si.....P.....k....?.+......s.....9..@....n. t..o...~)..Xk..F....C..q...t5.bV.#.#fC.._...'..{O....4.........YAq...A..%o.Zl AHm...4....fr_H.4k.....e._.<...N.....q&.c.P^+.C....X..5....\?8<.../.)?9......17(n.W.r......._.1.i;....Z......pl.4.Q.....u.9cs..N.Xc.#@.q$...uPt.]...g.....g.]..YX.... k!...id;...Yx.v.....1a.2...^Iw...o... .......,s...T\."!..).gK..I.F..1~. t.....g.9.X~>W......`b....3G.[...}%...']...[..Z.Q...jjx....M

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\ThemeList.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1083
                                                                                                                                                                                      Entropy (8bit):5.602790065569643
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:JdBHaPqjqobWDwjYvLPRioMjfGLkyvH8z:3Pq+4v9eZ1
                                                                                                                                                                                      MD5:1A43711E10689A071666EE439ABDC859
                                                                                                                                                                                      SHA1:D173A82DCA6DC00811350BD3F63C8B8323B0F759
                                                                                                                                                                                      SHA-256:76880D582882C914367F3CD34683C57DC6EA1051B7A89DC6CE9F612FEEA7989B
                                                                                                                                                                                      SHA-512:9FBA6A2D63B4E02E70DA3F7DCE50979CD547D89E49362A568549CADBC775849FF37DB30163F00B0CD85E023EE80187DAC93F5527BD34B11D0FC180EEB89F2F52
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="utf-8" ?>..<ThemeInfo>.. <ThemeList> 0.......-->.. <Theme id="5" name="...." package="Theme5"/>.. <Theme id="0" name="...." package="DefaultSkin"/>.. <Theme id="1" name="...." package="Theme1" down="http://dl.apc.360.cn/skins/Theme1.uiz"/>.. <Theme id="2" name="...." package="Theme2" down="http://dl.apc.360.cn/skins/Theme2.uiz"/>.. <Theme id="3" name="...." package="Theme3" down="http://dl.apc.360.cn/skins/Theme3.uiz"/>.. <Theme id="4" name="...." package="Theme4" down="http://dl.apc.360.cn/skins/Theme4.uiz"/>.. <Theme id="6" name="...." package="Theme6" down="http://dl.apc.360.cn/skins/Theme6.uiz"/>.. <Theme id="7" name="...." package="Theme7" down="http://dl.apc.360.cn/skins/Theme7.uiz"/>.. </ThemeList> .. <CustomThemeBkList>.. <BkPic path="PublicRes\Dialog_background.png"/>.. <BkPic path="PublicRes\MF_Dialog_background.png"/>.. <BkPic

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\skin\snap.wav

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):9319
                                                                                                                                                                                      Entropy (8bit):5.709760477776144
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:VSANTRi/piY1ampozS+ap7TeVXqbjnhrjaODb3FFDu8FOQNvQKqRlgHeSok7SZ:VpNTen1aoIYT9vnhfasb3HKGOQNONSoZ
                                                                                                                                                                                      MD5:509878B3E709B28DC2149542E25E4987
                                                                                                                                                                                      SHA1:A67A84B59A95245BF37600513C139927D8723457
                                                                                                                                                                                      SHA-256:90FF377047108C69EA3CEDEE01DE3613FBF4A61163583C03FCC15BAE6C2B1667
                                                                                                                                                                                      SHA-512:B4C53CD585B5C508ADD92DD74EDE8049768D66DAB209D795D01B850CD27882CDEE8F41FADCA3C9D29DD86A9EEF62B3154835B25EF5898EDFF47854E4EAE96FFA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:RIFF_$..WAVEfmt ........"V.."V......data;$.............................................................................~z{..qpy..g....~od....v~.vx..mx..yk..|]v..rg}..x{..`..iP..nluqE~..bh9s..`C7d..B-..Oa.....p=q...NY.p...j:a...AJY..YPe...h;4s....rcI..hdffv...u.....}Nat....sy..sdir....|..k_g.......z{xYj.......oYj..~r...WLz..u...u;y{o..]8].....NGmG;......^D[e@O....g73Z...}{x.PHp...|p...V^s..{vy.wr...og|...q_g}..r...]k..rmmou{......oas..|...|}xox......i_o......u..y..vu..uh..ycp..._rw.....]d........w....sv.{{...|....{in}....~xnp{......x~.{osx~...{uy{..~{~....w~..ot|....ysfz~.....~u..xss....g{..z...{..u{..u...v{..|..~}...wx......~z{|....|...x}..}|...~....zz......~...}...~}~........|{....|z.~..~~...................................~.~........|~.....|...}z}..|}}....~z}....v...|z...~||...~{{.......~}..........{..........~~..~|...........}}................~~........~{.......}}..||............|z........}~..........~...|....~{.....~...~....~.....}|.......~}...~}...{{{|~~~...}...}||}..~.

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\somcoredt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):825008
                                                                                                                                                                                      Entropy (8bit):6.5491447938841825
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:eY4r48i/je7GlpPMDV3be+wkhrx5dR/bPkuaYLdp2ku5ZGSlpTs6ILauDp:qr48i/j8YPMRrwk/RasdQkATfTB4p
                                                                                                                                                                                      MD5:AD7141EBC34468ECE687A5399FB1B05E
                                                                                                                                                                                      SHA1:159079879E57D6C1E4E599D7EBFA58EAC289D0F4
                                                                                                                                                                                      SHA-256:451ED78D762B64984402DC939228C00AE608FC9D1B1BC3BF6EDB767F27462FAF
                                                                                                                                                                                      SHA-512:99921BA6E7EC23C47B3AA9A275ABAF42B80EAF25773EDF13CD50DB60A00CEFB393DC376C238C31D1D66661771A2FB6844DFC576C2C325D29749E431EC2516A17
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......67..rVb^rVb^rVb^l..^wVb^...^sVb^{..^hVb^{..^.Vb^{..^.Vb^U..^tVb^U..^oVb^rVc^VWb^{..^GVb^{..^sVb^l..^sVb^{..^sVb^RichrVb^................PE..L...u4.Q...........!.....................................................................@......................... ...F............ ...............|.......0..dq..0...................................@...............,............................text...Z........................... ..`.rdata..f...........................@..@.data...<r.......>..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Bin\somkernldt.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1257928
                                                                                                                                                                                      Entropy (8bit):6.637557852291585
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:kCHfpvtT6uNohYg07OmzFCN26/5JIqfjNm+uoSNt7LJi4uUDzBeDpnE2IVs5Puwj:kCC5K7OmzF57Puo0aYuTBcPP
                                                                                                                                                                                      MD5:B04F80F63C9A0ABF6A287ADC4AC661E4
                                                                                                                                                                                      SHA1:54E9CB2396FD8708CF40B44F8D51DECEA38BC52E
                                                                                                                                                                                      SHA-256:BDBD8D832B8C6E8AFCFBA93FDC656629A34D7721FD2339D346A26FF2495268C0
                                                                                                                                                                                      SHA-512:7B9DDAB383E7482D05FB20A6106C2044779AFC2CBA557B953C812A8872B1272593BDC656C3BD2C7F70126BB4A852958BE84EEEAE69F3C9C12DA46C2140A9F4A6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[...:d}.:d}.:d}.B.}.:d}.B.}.:d}...}.:d}...}.:d}.:e}=:d}..v}.:d}.:d}.:d}.B.}A:d}.B.}.:d}.B.}.:d}.h.}.:d}.B.}.:d}Rich.:d}........PE..L...'..P...........!.....h..........................................................`.....@.........................`...[............0.......................@...}...................................................................................text....f.......h.................. ..`.rdata...W.......X...l..............@..@.data....(..........................@....data1...............d..............@....rsrc........0......................@..@.reloc..|....@......................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\LiveUpd360.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):399344
                                                                                                                                                                                      Entropy (8bit):6.525659947793564
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Q60nOaN+UpBOp+j1stF+sb6YkgXti5Y2ch+:QJ06fIQ5Y2S+
                                                                                                                                                                                      MD5:77106684F45C7C504B21AD948956734E
                                                                                                                                                                                      SHA1:5043039A8BC35EE71D8F17B921F35D6DEBF01831
                                                                                                                                                                                      SHA-256:F3803AB55BBFFFECA21BAB8BED43004A0DD019B1A97196602825E1D1D61C9554
                                                                                                                                                                                      SHA-512:4DC02E47B6071395D7CDA332CE74109F92682C7A00346C3DC0160D9747881D78A93F38B20A7C4CEB1B5E25B1E6CC86D3AAC98780AE40F3378C4DE007CA951C9D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qW. 56.s56.s56.s...s46.s.y.s46.s<N.s)6.s<N.s.6.s...s"6.s56.s.6.s<N.sU6.s<N.s46.s+d.s46.s<N.s46.sRich56.s................PE..L....q.P...........!.........>.......+...............................................l................................../............@.......................P..|....................................U..@...............0............................text.............................. ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@.reloc..@D...P...F..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\PDown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):210408
                                                                                                                                                                                      Entropy (8bit):6.507157820903005
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:TJnuJFUvm00JlB8uLp/Me7AQo7ZWQueVMAI64kliFa/nyG5e0P9:9nuJFUvSJP/Bid9/VMg4klfiI9
                                                                                                                                                                                      MD5:23944F2C8C2614814CD9EEEAD7C15622
                                                                                                                                                                                      SHA1:FE5BFBED6900D976AC56EAC386423D82A35BDE7E
                                                                                                                                                                                      SHA-256:68CB47636533713F460FA932975189BEFB0DDCA0750E8F75418B6C616F9BA3BA
                                                                                                                                                                                      SHA-512:C16AC9EB39375950E554CB6C2814ECD385D39F2729DC2B26618647705D99DE7A2626759C3DEEB8C8A12E7658ECE6A5569FB1EF5D01B8F1CB8CFFAD7EEFE92555
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................o.~......}......k.A....K.........h.....l......z......|......y....Rich...........PE..L....q.P...........!.....L...........N.......`...............................`.......3............................................... .......................0..`....c..............................`...@............`...............................text....J.......L.................. ..`.rdata...y...`...z...P..............@..@.data...@<..........................@....rsrc........ ......................@..@.reloc..^*...0...,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\Uninstall.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):249267
                                                                                                                                                                                      Entropy (8bit):7.821561013172663
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:kpDndxg7ab4Ho0b6exvxAWjdoZfVyuKDAJUFgi:2n3g7ab4f6exvxXjdagPDAJUF3
                                                                                                                                                                                      MD5:D164B3E10043192B85DE20E1CFE73DF1
                                                                                                                                                                                      SHA1:9F53A5145B67FEEF00C514D561DAA478BEF9DAE2
                                                                                                                                                                                      SHA-256:88E9FDD567AEB8D339C47BEB4B9B860E36CB4FD65837E65461B0479D15B51AA3
                                                                                                                                                                                      SHA-512:116357B40B90CB9B84F5E3D2DAE7C5DED16E73A67CF794060808833FB84846BDC5404CF5BB9943D9AF5E6BF4978FE79B64098DE8DBA517648D03D560967EE34E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................0...............................................s...........E..........8s...............................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....E.......F...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\safelive.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):397240
                                                                                                                                                                                      Entropy (8bit):6.559659900193761
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:gG1eHqeh0S21bC5k+5HsprlHPohiLesYTM7Pol5Cm6Kmvn7/OZcnPxNWj:h1eKeDp5kwMprlwYlYUPol5Cmdmvn4j
                                                                                                                                                                                      MD5:EF03AA3534F302E6A4DE1FA6BB6C9678
                                                                                                                                                                                      SHA1:6A67D0BD8BDDFBE0479BBDD4166281FF3DCD0D7A
                                                                                                                                                                                      SHA-256:E7CCEAF1534BEF4F656E72C8069BC82BBA836774868A39F5691E7D4BF9EF6450
                                                                                                                                                                                      SHA-512:650D9156F3A185801D1B57845ECEDAEDF1A392E5EB8341E5537AE082FE8D7D3749B30B6878A41EB4BF9204C4DAC535C3614859B1CD65D25CACB95695FA383540
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}..S2<..}....?..}.....}.....}...}...|.......}....).U}....8..}.../>..}....;..}..Rich.}..................PE..L.....kQ...........!.....z...v.......U.......................................P.......................................j.......S..@...............................L5..`...................................@............................................text....z.......z.................. ..`.rdata...............~..............@..@.data...D[...p...6...Z..............@....IShareO............................@....rsrc...............................@..@.reloc..2O.......P..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\360GameBox\updatecfg.ini

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3712
                                                                                                                                                                                      Entropy (8bit):5.295387915023677
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:ggdYrGQmy2IXDv7taKaxLX3ax5BSxpx/+Xgz:Xdjy2IXDv7ta7I4MXgz
                                                                                                                                                                                      MD5:0394045460416DEAC656997D9E126710
                                                                                                                                                                                      SHA1:15CF25FFE9A34A8DC6F7F6520B9E05AD72821CF8
                                                                                                                                                                                      SHA-256:3DC5C830D738BF21DBD9CAEABB8B4856664BD21D5A8E9FC3A8F1621D9EDB5756
                                                                                                                                                                                      SHA-512:F515B28577ECEEDDCE125CB0C335BBAF8A709D95A2575F38548589B93FF6004F82D7CA9EEB54046A81F88BA12144F259E866046E1E59F32D6F845CD2652C608D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[LoginGuide.png]..ver=1.6.0.1020..md5=5ec40557ccb2e9a39879ea799018eb26..path=C:\Users\user\AppData\Local\360GameBox\Bin\skin\GuideBalloon\LoginGuide.png..[360gbsc.ini]..ver=1.5.0.1010..md5=d41d8cd98f00b204e9800998ecf8427e..path=C:\Users\user\AppData\Local\360GameBox\Bin\360gbsc.ini..[GameCenter.xml]..ver=1.5.0.1060..md5=fc963ebf1ca23700f99af46b7893938e..path=C:\Users\user\AppData\Local\360GameBox\Bin\GameCenter.xml..[UiFeature.xml]..ver=1.5.0.1060..md5=5a9ea5d17938b505dab8374d23ef5f01..path=C:\Users\user\AppData\Local\360GameBox\Bin\UiFeature.xml..[ThemeList.xml]..ver=1.5.0.1010..md5=1a43711e10689a071666ee439abdc859..path=C:\Users\user\AppData\Local\360GameBox\Bin\skin\ThemeList.xml..[MiniAppdata.xdb]..ver=1.5.0.1010..md5=848e2c1f7b26a733d26d2f16ce8859b3..path=C:\Users\user\AppData\Local\360GameBox\Bin\MiniAppdata.xdb..[bg.jpg]..ver=1.5.0.1010..md5=b550092e07391f8185f571a9fa468123..path=C:\Users\user\AppData\Local\360GameBox\Bin\apppages\bg.jpg..[body.jpg]..ver=1.5.0.1010

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):111744
                                                                                                                                                                                      Entropy (8bit):4.01246373231805
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:xlr5kJGFj3W0jk0VDYcsmoH40RNWLyIujyHH0PO2kVR1vN/3lFJmyyp13ceWhtil:dkwj1Ycsmoi5htibGCnaGF1Kncmc8a
                                                                                                                                                                                      MD5:54F68C036160F2F38BB8EB280E6E8CF9
                                                                                                                                                                                      SHA1:6236043FA9C556651407E764FFE1A7ABF5DC3288
                                                                                                                                                                                      SHA-256:626535BEF03D0B9238E1C4B2352D42D045B97D41652CD4E267467D2A463EE40E
                                                                                                                                                                                      SHA-512:EE0B980E400B9A7A632414432FFE058217EB2135A0F367702F17A1A829F49390348234A1FD8BDBDF9945B222D84DE54A0F9E024D261AC02976BE1B6EA67D79F0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....h... ...............P...............[...x...a..........h...........Y.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):108056
                                                                                                                                                                                      Entropy (8bit):4.042068457230179
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:xlQXkbGCWO7rjk0NVY/zbnOOHUNILG2DjE6F4PrppR1vkmzN2emEypK3Tzx7e7h6:ck1W+Y/zbnOduhDiuGKnrJFnK3tY4
                                                                                                                                                                                      MD5:DF177055A2E41BE49173D5C58154653A
                                                                                                                                                                                      SHA1:5521F38141D3AC4F37609FCB8A9D70AC9B75D53F
                                                                                                                                                                                      SHA-256:5F56ACDEA011380AA18B8391AA96133D35B7F944B045C014EBACF8132D2C984E
                                                                                                                                                                                      SHA-512:B2BDDBD124AA60E993E0F56D1B9BED703FC90B0A2B6205ACF3C84BAA1BCF60679D613A9F39EE6D52FD2685D0015201B25CB00FE2B60534DDB40E5820CE4F3F81
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:....h... ...............P...............[.......a...p...................Y.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Windows[2].json

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):533
                                                                                                                                                                                      Entropy (8bit):5.194159847202084
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12:YWgc2T96nIH+56n+WoKD0sNH+2yrZMAE8kEUq1HLxyp3c3Z:Yzc2TEnIH7n+zKQgHt0BUER
                                                                                                                                                                                      MD5:832D80503D5FAAED64441757FAD9B534
                                                                                                                                                                                      SHA1:3D7D7DD546232E6742B5ABF4F2D95DE534D6540D
                                                                                                                                                                                      SHA-256:BC8CF55B76F82C549CB24C4F24A1869682A3156E3AAEA1EE057F360E21263E04
                                                                                                                                                                                      SHA-512:47B7204CE122AF2620D0F5E8787E54A0153CA36C68CAA28B0FFCDF6FA71D2FE15A6E60CDB67561D7998E933A38352275180F5ACA4E4CE289F78838E2FD321D66
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:{"serviceContext":{"serviceActivityId":"658e065c-8d25-4401-9da3-4591b777b097","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"658e065c-8d25-4401-9da3-4591b777b097|2023-12-28T23:35:56.6152509Z|fabric_winfeed|WUS3|WinFeed_576"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"webView2Enabled":false,"webView2EnabledV1":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false},"isPartial":false}

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\360desktop.setup.log

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):465492
                                                                                                                                                                                      Entropy (8bit):5.391937628480318
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:YQulmSuTDpbBFAuqqcsLPpwwaYM9DNgKQnugeqU3ag+RGYzm9zX:Y
                                                                                                                                                                                      MD5:A4742CF312EC6B5A8F14FD7E304DC778
                                                                                                                                                                                      SHA1:42CC661AE53BB7FB3CA1CDEE650DA8687365E99B
                                                                                                                                                                                      SHA-256:C22BD02FE155BAC5F06C120C41C9AF51C7D8AB073FDC1C5758748AC88572E6F9
                                                                                                                                                                                      SHA-512:9D9E734543213A6FC4A4D59EC0BF23CB236AFDD032D4DB8C7458637E6DCBBBD91E957CC334BBD4E60144A08ADD164433175D642251EC73D1E220A714964268AD
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:2023/12/29 00:34:49:989 Begin setup......2023/12/29 00:34:49:989 Command Line: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe"..2023/12/29 00:34:51:239 waiting for Click Start button ...2023/12/29 00:34:58:364 ...2023/12/29 00:34:58:364 ////////////////////////First Step////////////////////////..2023/12/29 00:34:58:364 Start Prepare initial information.......2023/12/29 00:34:58:833 Start install thread... ...2023/12/29 00:34:58:848 ExitAllProgram Start, Dir = C:\Program Files (x86)\360\360Desktop..2023/12/29 00:34:58:926 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt.dll..2023/12/29 00:34:58:926 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll..2023/12/29 00:35:00:333 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll..2023/12/29 00:35:00:551 Register plugin dll start: C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll..2023/12/29 00:35:00:817

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsiAB57.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1646174
                                                                                                                                                                                      Entropy (8bit):7.782492820242828
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:su6QvwF0DBQcp7wSXXpW43NVyM3NNJ5Okm:qQvF+YwAIGz3Okm
                                                                                                                                                                                      MD5:805920E70DCCF7812F54015AC98D2D03
                                                                                                                                                                                      SHA1:2912DE94662394F9461BBBE781CC3EB4597B957E
                                                                                                                                                                                      SHA-256:E57B7CF635EB067F75CC8EAE6B33CB3882041AA4128EC46460C6BD1A7C0F9264
                                                                                                                                                                                      SHA-512:515C86D81307187D27D685B380A00416BDBD0494D1BE6C58AA09D4CD262D6254BF992319719F63AD2C3EACD1E46C74D1DC4C0260A99B000F76FE9C40F8201F18
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:........,...............4...U...........g.......y...............................................................................~............................................................................................................................................................................*..j.......................B.......................................................................................................................w.......B.......................................................-.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\NSISdl.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14848
                                                                                                                                                                                      Entropy (8bit):6.042975836390264
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:/4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12FgszA:/ysdM80dCI5a2LsQ5IlPNRY00AlAbU
                                                                                                                                                                                      MD5:A5B84D250794433DB5A2D26F34699DD9
                                                                                                                                                                                      SHA1:BC06ABCCF6A4783973EC11B6766B43B4A265820C
                                                                                                                                                                                      SHA-256:96F3357A024C549D7CB9E6447B1A56A2A8029B4F12E6E597428E68620761C5E0
                                                                                                                                                                                      SHA-512:121D67F85A24096799ED913DCCB64EF65D9479F98A6D88C2A0E05F05A65F460D557C5FDFE2C42A0A61B9CBAEDD9B7031978111A2713250A89848AB4F3BB4CE84
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Ht..H...H...H...Ht.H...H...H...H...H...HRich...H........................PE..L.....pG...........!.....&...p.......".......@.......................................................................D.._....@..d....................................................................................@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d...P.......0..............@....reloc..,............6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\SetupHelperGB.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):109432
                                                                                                                                                                                      Entropy (8bit):6.488111778836435
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:u6L4wfzGPnGWS562bthxJmRGydoKLknTvpxA5sHcS1VqYwCaW:u6LbfUnnWFJmgoLkzpC5s8UVqNW
                                                                                                                                                                                      MD5:2E7E6956B137F083FE37FC4857BBA754
                                                                                                                                                                                      SHA1:3B175387719FAEA3A2610308EF4C9357DE18D0D8
                                                                                                                                                                                      SHA-256:23F44F3117E1DC0CB188460249D7C5691DD24152A3C7AFDC4D80F42E439EB1D6
                                                                                                                                                                                      SHA-512:AC8E6FCD389CD4E73AAF20F4997A82E4257448E81AA64179CB3CC996A480A78630A49A8F3EDEF4D3D68425DDF47131B0FA486CA2E6B0432F5C87B64CB65A94ED
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.=T3.S.3.S.3.S.-...7.S.:...$.S.:...A.S.:...;.S..x>.2.S..x(.".S.3.R.E.S.:.....S.:...2.S.-...2.S.:...2.S.Rich3.S.........PE..L......P...........!.................c....... ......................................~`...............................U......TL..........................x............!...............................A..@............ ...............................text............................... ..`.rdata..l6... ...8..................@..@.data...<G...`...$...L..............@....rsrc................p..............@..@.reloc..T............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\System.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):10240
                                                                                                                                                                                      Entropy (8bit):5.850825628811053
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:IDO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:TKAFERdlxhGRYUzqZaf
                                                                                                                                                                                      MD5:7D85B1F619A3023CC693A88F040826D2
                                                                                                                                                                                      SHA1:09F5D32F8143E7E0D9270430708DB1B9FC8871A8
                                                                                                                                                                                      SHA-256:DC198967B0FB2BC7AAAB0886A700C7F4D8CB346C4F9D48B9B220487B0DFE8A18
                                                                                                                                                                                      SHA-512:5465804C56D6251BF369609E1B44207B717228A8AC36C7992470B9DAF4A231256C0CE95E0B027C4164E62D9656742A56E2B51E9347C8B17AB51FF40F32928C85
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.............................S...........Rich...........PE..L.....pG...........!.................(.......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...?........................... ..`.rdata.......0....... ..............@..@.data...\....@.......$..............@....reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\registry.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):16384
                                                                                                                                                                                      Entropy (8bit):6.15541350371607
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
                                                                                                                                                                                      MD5:24A7A119E289F1B5B69F3D6CF258DB7C
                                                                                                                                                                                      SHA1:FEC84298F9819ADF155FCF4E9E57DD402636C177
                                                                                                                                                                                      SHA-256:AE53F8E00574A87DD243FDF344141417CFE2AF318C6C5E363A030D727A6C75D1
                                                                                                                                                                                      SHA-512:FDBBEDCC877BF020A5965F6BA8586ADE48CFBE03AC0AF8190A8ACF077FB294FFD6B5A7AE49870BFF8CACD9E33D591BE63B5B3D5C2E432C640212BDCD0C602861
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{\g.?=..?=..?=..]"..8=..?=..#=..:1V.>=..:1U.>=..:1S.>=..Rich?=..........................PE..L...s3.I...........!.....,..........4........@...............................p.......................................F......`C..P............................`.......................................................@..|............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data... ....P......................@....reloc..H....`.......8..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nstAC80.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3744237
                                                                                                                                                                                      Entropy (8bit):7.107780927813367
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:98304:91maY0MgwsDdFw0VEhRXtT0KqfHhpFKLZc9b6fHNmiQMOI8YBfsu:maYYwsvwZPXtYKmBpdbWET+
                                                                                                                                                                                      MD5:F7CD1D4E4C9897A9D5858BCBBF4F9C8D
                                                                                                                                                                                      SHA1:659467931C4F26B1B4B1A766E9C5341A335153DC
                                                                                                                                                                                      SHA-256:93ED031A4ABE02C9AE84CC1CECE31FC015995C317627E04B445595A0C03F36BE
                                                                                                                                                                                      SHA-512:EDC8B7C137BB8F36CAB6A9C872A8665C949CED23E5ECC52642E2558E50250096BE0EB7F93688C5507280DE618E1BF055517FFBACDA51ACD67117D018CE38AAE7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:........,...................4...........G.................................... ..C ......................F.......z...@.......F...,............................................................................................................................................................................1..........B.......................................................f.......................W.......................Y...............g.......................W.......................................j.......................W....................................................................................................................... .......W.......................................................).......................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\360verify.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\NSISdl.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):14848
                                                                                                                                                                                      Entropy (8bit):6.042975836390264
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:/4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12FgszA:/ysdM80dCI5a2LsQ5IlPNRY00AlAbU
                                                                                                                                                                                      MD5:A5B84D250794433DB5A2D26F34699DD9
                                                                                                                                                                                      SHA1:BC06ABCCF6A4783973EC11B6766B43B4A265820C
                                                                                                                                                                                      SHA-256:96F3357A024C549D7CB9E6447B1A56A2A8029B4F12E6E597428E68620761C5E0
                                                                                                                                                                                      SHA-512:121D67F85A24096799ED913DCCB64EF65D9479F98A6D88C2A0E05F05A65F460D557C5FDFE2C42A0A61B9CBAEDD9B7031978111A2713250A89848AB4F3BB4CE84
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...Ht..H...H...H...Ht.H...H...H...H...H...HRich...H........................PE..L.....pG...........!.....&...p.......".......@.......................................................................D.._....@..d....................................................................................@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d...P.......0..............@....reloc..,............6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\Registry.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):25088
                                                                                                                                                                                      Entropy (8bit):6.16866702253594
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
                                                                                                                                                                                      MD5:2B7007ED0262CA02EF69D8990815CBEB
                                                                                                                                                                                      SHA1:2EABE4F755213666DBBBDE024A5235DDDE02B47F
                                                                                                                                                                                      SHA-256:0B25B20F26DE5D5BD795F934C70447112B4981343FCB2DFAB3374A4018D28C2D
                                                                                                                                                                                      SHA-512:AA75EE59CA0B8530EB7298B74E5F334AE9D14129F603B285A3170B82103CFDCC175AF8185317E6207142517769E69A24B34FCDF0F58ED50A4960CBE8C22A0ACA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..]...]...]..|R..]...]...]...Q..]...Q..]...Q..]..Rich.]..........PE..L...PxEN...........!.....H... .......#.......`.......................................................................i.......f..P...............................<....................................................`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data........p.......X..............@....reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\System.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):10240
                                                                                                                                                                                      Entropy (8bit):5.850825628811053
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:IDO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:TKAFERdlxhGRYUzqZaf
                                                                                                                                                                                      MD5:7D85B1F619A3023CC693A88F040826D2
                                                                                                                                                                                      SHA1:09F5D32F8143E7E0D9270430708DB1B9FC8871A8
                                                                                                                                                                                      SHA-256:DC198967B0FB2BC7AAAB0886A700C7F4D8CB346C4F9D48B9B220487B0DFE8A18
                                                                                                                                                                                      SHA-512:5465804C56D6251BF369609E1B44207B717228A8AC36C7992470B9DAF4A231256C0CE95E0B027C4164E62D9656742A56E2B51E9347C8B17AB51FF40F32928C85
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.............................S...........Rich...........PE..L.....pG...........!.................(.......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text...?........................... ..`.rdata.......0....... ..............@..@.data...\....@.......$..............@....reloc.......P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{15489BE9-02A9-4aa0-BA09-BE8874CC1ABF}.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):152799
                                                                                                                                                                                      Entropy (8bit):7.99879211153661
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:3072:sK/zHx86nzLMMDj99IJVK+CUlXC7Kmkfj0mTAWMCGsI4zS0wwg:sKzx86zLMMD5mPzekfj5FMC/IiSjwg
                                                                                                                                                                                      MD5:7CA3EABBAE526A7D31752F0B34BDF3D8
                                                                                                                                                                                      SHA1:D3E9993081E9D17FC53E0A2079425A32F6A64A7F
                                                                                                                                                                                      SHA-256:BD55FE648CB7C8A80D0DB1235EB431141EA4655EEDA3910FF3CBE263579D330F
                                                                                                                                                                                      SHA-512:A2AADFEE753A04483BD0D898DA4B652901B88DF5955CE8FBAB8B91FE1CEF5A2068B95C3BFC6D76A6FE5E6A5384B5ACF48486BE73E31F39BDE623633D586D1D81
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:7z..'........T......#..........g.....]....D.....%..k.I...d.4.;tK.....f.*........$3\.A.igyd...*..w`2.gE..".U....,(.?..&......$?.+...|:.<...%..h.|......^...)..J.G%.l.L..I.gR.....w.@7..&i,..N~...q9..*~f....K.<\.;&.n..M.d..a....++..R;.Cl3..g.|.....PM.".&!....EHc..2pa..t;.mIU.lz.....u2Yj4k..=.`b.n.'........HP..9#+j2..{xf.).b..G.P.c.Q.(A.|$..`...+.A...ve$...4...r...x.......".j.S=.h...z.....xe.....K3 ..wz].+..V..~Z.t........0..j.D.......W.N....f9..&g..X.V.../...k.J.Q.S+...Bn5....N.a..{..;_#.vU.6.}?....@b..9.%......x..&..D..`*.$h....M..e.F..:.u.M...._.Y.V...M.....'..MT..;..e.Syd....4......O..m.u..)..p:%tIzj....i.N.w.*.:W. F.0..inX..Qm.A..t..._.Qu.\.@..B>.V..~8F.[|...7.8..+..`.....5.3.(..Eu..TV...F.L.......>..q_a..K..y>.....\.|9...y.!L..3..N&.:...c&.........:h..h>.H. .....\.^.."....M.%O..7.^......T.\.5...(G..}j..|......:$\.I..\...:'z..G9.T....rO..................W....X...C./...2.F........$.....H....z.N.B[yy.....%...R.....Y.^*..i^.i...7

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{6C61835E-E330-41d7-898E-372024AA379D}.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):12042
                                                                                                                                                                                      Entropy (8bit):7.98360030040336
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:BfizEnYi6yugf59kbVj11o6LHQU7t9KqWXfE4IJS8ZvlE9qRBGxfj/fl:BKzwaC59Uo6zQYt97WuJNZvlem8xfbN
                                                                                                                                                                                      MD5:AFD4E227874CA2557C924860755505A9
                                                                                                                                                                                      SHA1:978A6B793BFD66712B76B7AEE2AE858ED78FD319
                                                                                                                                                                                      SHA-256:3A48D6C8104496B0DB6C356379165BA362375EEA6819E81B5177B4ED435B3522
                                                                                                                                                                                      SHA-512:7B65DEEC2D9518E325DC558994D4D1FBD5BD94595B8B62140BD3368CFBDAC35BE74D3426CB5A3D0D6B4F1AB42543BFCBE518294E69FABAA266B152D76639ABDC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:7z..'...-J..........#.......Q....n.-.]....D.....%..k.I...d.4.;tK.....f.*........$3\.A.igyd...*..w`2.gE.."....(RK....../U....$L_...z7.?..\...4.GL...5...E$,L...Kq...k~...+!F2D../...Ou?.............,.."XzB..,h.\].+................f.e...I[..+.#..4..(.a...H*%.....pt..-....e.2.v..V(.j....W.<W.zz.Q......c..I7.\...|4*.[.l/@X...t.3.....s.<D.E.U?m.....C.%.t.*..@q.D.N.P.w....1..O...1..U(..Z.#..3Sm..#...;.....,...+s'.Y/..c)c...,UjQ\...~2..23y..7.......r......k.-....}kUO....6..}:......b.U..S,.`/..|..#..j^^.*..Ge..#....f..k.Y..|...%."......tC.g&E....ze.#......4.4 9.Inj..a..!@..J.t..F..).3]..y)$..........B.?}..F....89...#\..+Uvs<.@...W...ZEs..^./..B..'.0.-.VP..#..8....U..0*.P..?%..f.MH..4.....?..s.8V.U<..3..@.....1...Yp.@dHj.VV....9.......V;.".>-......+'X...F.W..:.k....X$.B.UF9.Y\...._Y...vkx!RL.......c..g..[......WB....S...8.c.2.......7.....e)u....f.....ov6..;.0...Y......2..T.1..,.Cm.y.].....3..'.....N..m.nS.r_W"..M]............y..3....<..

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{7B893064-B4AE-4242-8CC3-858A8B4FE14C}.tmp\7z.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{8BA98B53-011F-40a2-8B0C-D0C87CFC6457}.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 213427 bytes, 1 file, at 0x2c +A "7z.dll", number 1, 12 datablocks, 0x1 compression
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):213427
                                                                                                                                                                                      Entropy (8bit):7.997611527006153
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:3072:ZPx9oLEP6UF3FN1lm6zjRiJagudaE6Hdo0s+2no/WTYEeq9z5IGsfBxNt6AeD:ZPx9oLC5FVVAJXudaE2KnosYJ8wxN58
                                                                                                                                                                                      MD5:959BECB9902B8CBA0C02E93F79ED6535
                                                                                                                                                                                      SHA1:E3C78D1CEACA1C581AFC61BCEAB0033D321B30BD
                                                                                                                                                                                      SHA-256:028E84D1F68F2D6AC617F3FE4B08D2AF7FB94931132380494A2EB92750A50CF6
                                                                                                                                                                                      SHA-512:9537AF6F840DE62FBF5282C453CBD7D22DEF3EF93AEDFA6B85FC0CA1644AF278D5B65DB0568A54D865EF02F3E993973C5824C844E03A6129792C88410EF0693C
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MSCF.....A......,...................C..................Av. .7z.dll...4.yM..CK.}|..8>..$.d.,d.(.B.....UI\...&A.!$!B.^u.[k1.IX.l..8.-z......._....]bI......QO.A....=...^.....~|43s^......u..$g.8N..u...9............)..../....+.X....G........C?.e......C..<.]tgE...t..7.....kcM...{]......L....Yf.3....M..b...Yhi........;X.c....}/z.....0.....O..l.;...OM.8....<....... b...=....]xr.$.1.`.f......x.5%r_....D.u<.....v'r...$.W7C._.\.?0..&C....>.......y._b.......o.....=...'bc...'......(..=.....w5<../-...~U..14.9...'^.^........7p........._A........?O.(..U..X.r.,9..8.....''..>.W...K.8~..;*.2`.."G..).q.^.Z4...._...K....Q.-p.;.@P.J.`...c..W[.c;df~...Pv..P.I.K_^.twG..Y......j..(..?.....N.6.$..`.F..b..z.<.3)....i.er{....K.w...6L$..B`.....-.1......p....,n.'.^....k.r...t..O\C...S. ....i..3..Y..2.C.".k;fO.Q..jm.>...*.o...~=jm/......Q>w....E.|...9.|3.....=..l%8..7... {.Z(...t."..hs.5W/}j...o+X2Cz:...8..8.{..:wx.....q.K/.9.^.K/.:..9.....a.....[

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{9F0A4041-4B7E-48bb-8CA2-8C474BD03C91}.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1177688
                                                                                                                                                                                      Entropy (8bit):6.566981597578591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:hmAickpYIlJwnR4F9BMt10HLXZSOzFeCfGCEXkWE2ayCMqM02yEhmAS1SD0YyqTY:n0YIlJwnR4F9BMt10HLXZSOzFeCfGCEM
                                                                                                                                                                                      MD5:4A21ACD5FDB8E006E5CCFB259B557106
                                                                                                                                                                                      SHA1:146CA6B76B8BF54E7C640D46AF353E9F84423972
                                                                                                                                                                                      SHA-256:63360E5CD4806E6711E49878ACE346136AE829AB4EFA6C354753860E9A02BFE9
                                                                                                                                                                                      SHA-512:A4C1023C138FD1E8CBB31E8BCDB65A16EE8D7518A6BE44B127A585DE66F19DD82B43FC4953FD68C276763EBBE6CE5152970A524257218A961A0C862F16BF7E45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...ue.ue.ue..*t.ve.|.w.Te.R...we.R...fe.ue..d.k7f.}e.|.f..e.|.a.sd.|.p.te.k7v.te.|.s.te.Richue.........PE..L...g.vO...........!.........................@...............................0..........................................A..............................X.... ..\....F..............................`...@............@..h...l...@....................text....,.......................... ..`.rdata..1....@.......2..............@..@.data....w.......R..................@....rsrc...............B..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):385984
                                                                                                                                                                                      Entropy (8bit):6.638785122041984
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:NBwDAtnc30dlG5en9ZJvAX/rFoV4QSHK4o4hgmCjcpqqCV/HhI+QLeG:DHc30dlG5enz1OLK4o4hujcpRCV/WLeG
                                                                                                                                                                                      MD5:915427E600ECABB39F9EF53F5713AAB7
                                                                                                                                                                                      SHA1:440C77EFDFD8701E4435C6B95B9F18D0DD59E0FB
                                                                                                                                                                                      SHA-256:6C1E5F6ADF7D0B40269CD710694CDCA8DC38B280861852C9BB6C8F70635F5FFD
                                                                                                                                                                                      SHA-512:CB9A1970AC8D8008F7CB8D8F67B12BA11CD67F1A3E55F87A69EFEEBA8AC0F4FFD3A6634EC3C60E3F312043338DCECDC078DC98C6ED0909E5DDC3F5269DEFF34F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.#C3cM.3cM.3cM...C.!cM..k..2cM. k..1cM..k..6cM.3cL..cM..|G..cM..eK.2cM..|F.LcM..|I.2cM.Rich3cM.................PE..L......P...........!.........B.......v.......................................@......7...............................0~.......q..P.......@...........H...x........4..@...................................................8............................text...&........................... ..`.rdata.."...........................@..@.data....n...........r..............@....rsrc...@...........................@..@.reloc...8.......:..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{CF943540-C2E3-43cc-9B55-E4222D53DF15}.tmp\MiniUI.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1177688
                                                                                                                                                                                      Entropy (8bit):6.566981597578591
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:hmAickpYIlJwnR4F9BMt10HLXZSOzFeCfGCEXkWE2ayCMqM02yEhmAS1SD0YyqTY:n0YIlJwnR4F9BMt10HLXZSOzFeCfGCEM
                                                                                                                                                                                      MD5:4A21ACD5FDB8E006E5CCFB259B557106
                                                                                                                                                                                      SHA1:146CA6B76B8BF54E7C640D46AF353E9F84423972
                                                                                                                                                                                      SHA-256:63360E5CD4806E6711E49878ACE346136AE829AB4EFA6C354753860E9A02BFE9
                                                                                                                                                                                      SHA-512:A4C1023C138FD1E8CBB31E8BCDB65A16EE8D7518A6BE44B127A585DE66F19DD82B43FC4953FD68C276763EBBE6CE5152970A524257218A961A0C862F16BF7E45
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...ue.ue.ue..*t.ve.|.w.Te.R...we.R...fe.ue..d.k7f.}e.|.f..e.|.a.sd.|.p.te.k7v.te.|.s.te.Richue.........PE..L...g.vO...........!.........................@...............................0..........................................A..............................X.... ..\....F..............................`...@............@..h...l...@....................text....,.......................... ..`.rdata..1....@.......2..............@..@.data....w.......R..................@....rsrc...............B..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{E9BBAFFE-DC9C-41ca-952E-709B02BF5E26}.tmp\360Desktop.setup

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2818
                                                                                                                                                                                      Entropy (8bit):3.8559297372687213
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+sO0rEMpNgwp2QaXlUrMlUC4PvNL2mrErXflzlfotMEyEd1GMZZBBCtGcsZBBCF:9KgwTaXjKWXfp9OMBTMZZCIcsZC4kZCw
                                                                                                                                                                                      MD5:00F3065E2E29E877451434AA09D22208
                                                                                                                                                                                      SHA1:8E2B2D93EF47F4B2B3E9F832981791A909C45C7F
                                                                                                                                                                                      SHA-256:44CE1F2F7F9151376E3FC61E55C1307244ABA0124CF39FE184DECE73F2D7504A
                                                                                                                                                                                      SHA-512:8C31B6262C3CF6F0D7A5288AEA358B0D7866F9E93BAD35AB2CF7AD0A0BB6AD908F03E6AB526A1268AD7803B9A75ADE3DB5D8DCED56920FEB5D3D4484F277EABA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.S.e.t.u.p.>..... . .<.M.a.i.n. .N.a.m.e.=.".3.6.0..[hQLhb.". .P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .V.e.r.s.i.o.n.=.".2...6...0...1.1.1.0.". .E.x.e.c.u.t.a.b.l.e.=.".s.e.t.u.p...e.x.e.". .T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%..[.". .U.n.i.n.s.t.a.l.l.T.i.t.l.e.=.".3.6.0..[hQLhb. .%.V.E.R.%.xS}.". .M.i.n.i.m.i.z.e.S.p.a.c.e.=.".2.0.0.". .R.e.b.o.o.t.F.l.a.g.N.a.m.e.=.".{.0.9.5.4.A.A.0.5.-.5.D.7.1.-.4.3.4.a.-.8.0.A.6.-.1.0.A.1.A.F.4.1.F.5.C.C.}.". .M.u.t.e.x.N.a.m.e.=.".3.6.0.D.t.I.n.s.t.a.l.l.e.r."./.>..... . .<.A.p.p.l.i.c.a.t.i.o.n. .M.a.i.n.A.p.p.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.". .V.e.r.s.i.o.n.B.a.s.e.F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e."./.>..... . .<.R.e.g.A.p.p.P.a.t.h. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p. .P.a.t.h.s.\.3.6.0.D.e.s.k.

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{E9BBAFFE-DC9C-41ca-952E-709B02BF5E26}.tmp\Plugin.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3902
                                                                                                                                                                                      Entropy (8bit):3.5557288835319474
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+JVZlplUZlplfZlplEZlpljotElpl9ZlpljvZlpl9Zlplyn5ibEn5+vEnvlmpgS:dmfGp11p1FAfpE1otR3omfGpWA
                                                                                                                                                                                      MD5:2DD2E9A30A526F127ED55D471E414368
                                                                                                                                                                                      SHA1:80EE609ADD556B87E95BBF1C77ADFD0FE2DB05AD
                                                                                                                                                                                      SHA-256:FF9B5847CBCDB3E9DF84505057E7CD36317308944526EDA5A042C3C81492CCE1
                                                                                                                                                                                      SHA-512:CF85057B916932FE0CD7CB2FE0A183873C41868CD6EA72F13C7AB2058E37F29EA358ABC43B11D2BF9E086047970D43D2B974D8951D9D37BD24F10BEE041E0F1E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.P.l.u.g.i.n.>..... . .<.B.e.f.o.r.e.S.e.t.u.p.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".3.2.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.h.e.l.l.3.6.0.d.t.6.4...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".6.4.". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.S.M.W.e.b.P.r.o.x.y.d.t...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>.......<.I.t.e.m. .T.y.p.e.=.".S.i.m.p.l.e.D.l.l.". .F.i.l.e.=.".B.i.n.\.3.6.0.D.e.s.k.t.o.p.M.e.n.u...d.l.l.". .E.n.t.r.y.=.".D.l.l.U.n.R.e.g.i.s.t.e.r.S.e.r.v.e.r.". .S.y.s.t.e.m.=.".". ./.>..... . .<./.B.e.f.o.r.e.S.e.t.u.p.>..... . .<.A.f.t.e.r.S.e.t.u.p.>..... . . . .<.I.t.e.m. .T.y.p.e.=.".S.

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{E9BBAFFE-DC9C-41ca-952E-709B02BF5E26}.tmp\Register.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2256
                                                                                                                                                                                      Entropy (8bit):3.5953053564026893
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y++V47t7uJWg3oMDgVir4pMQaRkqcPsAwY:63qwvY
                                                                                                                                                                                      MD5:35AA95AC9AC71D0FAD5E19C511FFFD2A
                                                                                                                                                                                      SHA1:ADEEA5639F4C9558C44E73188CBD24C207FA7012
                                                                                                                                                                                      SHA-256:7F9E467EF207FFB4F524C93AF58FE5E9718FF2F0BB2A7B8359FE44AAC1DE509D
                                                                                                                                                                                      SHA-512:9ACCC1BDDDF6B4AA4DE212439D415A04A3BCA96F1F21B90A8CA9D65C88177DF91EE001DC940A57B61A5DAA9B70EAAD86BA76712780DCCE31376CB6580EE9DB98
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.e.g.i.s.t.e.r.>..... . .<.I.n.s.t.a.l.l.>..... . . . .<.!.-.-.>.......<.K.e.y.I.n.f.o. .H.K.E.Y.=.".H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.". .S.u.b.K.e.y.=.".S.O.F.T.W.A.R.E.\.3.6.0.D.e.s.k.t.o.p.\.s.a.f.e.m.o.n.". .>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".E.x.e.c.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".S.i.t.e.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".I.E.P.r.o.t.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".3.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".M.o.n.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".U.D.i.s.k.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... . . . . . .<.I.t.e.m. .N.a.m.e.=.".D.r.v.F.W.A.c.c.e.s.s.". .T.y.p.e.=.".D.W.O.R.D.". .V.a.l.u.e.=.".1.". ./.>..... .

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{E9BBAFFE-DC9C-41ca-952E-709B02BF5E26}.tmp\UninstallRootDirFileList.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2330
                                                                                                                                                                                      Entropy (8bit):3.4422158512260266
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:48:y+hUlzbb23QmSt2n16n1MHssRJlACXApDXeXyVBVaY636BhNvVPc:WUUu1i1NerACXAleXsBpb6
                                                                                                                                                                                      MD5:55EA164B6BB418440F4659D7AFDE63EA
                                                                                                                                                                                      SHA1:A54EF67DA77A369803FA4DBDFC3FE82A3864B622
                                                                                                                                                                                      SHA-256:991B63FF2711AF2A635C9FC01FC296BC0A30B0ACA3CB0778E798349449F4CAF9
                                                                                                                                                                                      SHA-512:68378479009533964F60AD7E3E515ABF573FB2E306231B9C3E867FC3B663A50DBE8A6DC7C0B1FB3453B7B69C9C52C50345F1719EE0CEF63C31BCC40E548FB1BB
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.R.o.o.t.D.i.r.F.i.l.e.s.>..... . .<.D.i.r.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".B.i.n.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".C.o.n.f.i.g.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".s.a.f.e.m.o.n.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".b.a.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".L.i.v.e.U.p.d.a.t.e.L.o.g.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".u.p.d.a.t.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".D.T.F.e.n.c.e.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".l.o.g.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".m.o.d.u.l.e.s.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.". ./.>.......<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.l.o.u.d.D.e.s.k.C.a.c.h.e.". ./.>..... . .<./.D.i.r.>..... . .<.F.i.l.e.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".7.z...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". ./.>..... . . . .<.I.t.e.m. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". ./.>..... . . . .<.I.t.e.m.

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{E9BBAFFE-DC9C-41ca-952E-709B02BF5E26}.tmp\filelist.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):82552
                                                                                                                                                                                      Entropy (8bit):3.7230656395395596
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:768:15GYKRpRvAERQ3J3HzoE4oltGT8r2rchp+r+8D9NLx:15GtRpR7RQtrHa8r2jFD9NLx
                                                                                                                                                                                      MD5:C9B3EF7097B1EB528A71EAD78B2CEEEB
                                                                                                                                                                                      SHA1:803FC5D048BF9B6370BFCA85ABB0CC80B0701CA2
                                                                                                                                                                                      SHA-256:8DBA5E7360352A2317F34F5C5CB7D712BD417F82D2B11C4C395695B5EAC049F1
                                                                                                                                                                                      SHA-512:9038E006FB468AE4ECCDFBA131A1CB89200D225C5A8B4E4D764EFC279C01BF1ADCBBDB90A8F7065CBAA1BA561D03E892CC2B964E18A8B395BAF2182A4861B1AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.F.i.l.e.L.i.s.t.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.C.o.m.m.o.n...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".7...3...0...1.0.3.5.". .S.i.z.e.=.".2.7.1.9.6.8.". .M.D.5.=.".2.0.E.6.9.F.7.B.5.5.E.A.4.F.7.A.4.8.7.3.6.A.1.9.3.8.9.B.D.2.F.9."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.d.t.p.r.e.v.i.e.w...e.x.e.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".2...4...0...1.0.4.1.". .S.i.z.e.=.".4.7.8.0.5.6.". .M.D.5.=.".8.7.0.1.0.9.6.D.5.7.2.C.5.6.D.F.7.C.4.1.F.A.1.9.8.7.B.6.9.6.6.7."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.n.e.t...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...2...0...1.0.4.2.". .S.i.z.e.=.".2.7.5.2.8.8.". .M.D.5.=.".E.6.F.F.7.6.3.A.4.A.C.9.1.2.3.2.9.7.9.5.6.0.5.2.5.E.1.2.E.4.C.3."./.>.......<.F.i.l.e. .N.a.m.e.=.".3.6.0.P.2.S.P...d.l.l.". .I.s.P.E.=.".t.r.u.e.". .V.e.r.s.i.o.n.=.".1...3...0...1.0.8.0.". .S.i.z.e.=.".7.2.4.6.0.0.". .M.D.5.=.".6.4.0.F.3.3.B.0.0.5.9.E.D.6.E.B.8.

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{EEF26BCC-3ECA-406e-B510-C46C95B3386E}.tmp

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):392961
                                                                                                                                                                                      Entropy (8bit):7.999518664058607
                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                      SSDEEP:6144:MjciTzRE1eGcN9A097Q5Diw0PKIHVTKAzNhbm5RQTcCCm:WPKol9d9twaHVTKAzOQTX
                                                                                                                                                                                      MD5:20504F4D335ECB55B44085F8FA59825D
                                                                                                                                                                                      SHA1:2B04705117DE7CF59DD57CFAB5BD42B9C65ECAC6
                                                                                                                                                                                      SHA-256:FE076C937B0319F4C16130898C36DAC271C7C7D36FBEE28133949F8BAD22184B
                                                                                                                                                                                      SHA-512:CA8312C7D4F03BAAB168D8699C9369146CC046A77A39581FC15114FDE24224C6D547A7EA1A85E8CF18200252874FE1158152F3BA645700AFB709113E4DEDA3E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:7z..'...Qgy`O................{.{.n..$].&..p.........../D.|..(....U..)..B.s.Q....L...Bf...2f..'.6...gg.D.....(.[.[...1.Ic+...,.M.cH.-,.z......"...\[50...k...N.V3...(,vb...uFx.BKF.vG.4.r.NG..9.B....$n....._.....w."..w...>..}.v.GG.WhA.....[9j>...2.6.PF...G...vX.D.d.....?.......eD....Z.;..|~2.m..i.<.T...B..h.5...V....k...y.(l....(yK_.R.3.....mg.h.R.L..r...(.....id .#2.u=.........L.0|4.2...-h.o...*.\.W.X.5.j.T}...\.|[.).(m7"[.3.v.. 9...x..<U..Vw!.s..zv.>..N..TQ.!T.Y.-....X.c..uk.M.*`.|....4...5..)X.B'....'..Xhl..a..ON..>.d.w1../.....1..I.4..F.....z:})+.....`..U......J..YI.j.D.,.EZ..v..M*.m.....z.......3..Gr.K....c...'.:.....u<..L...Em...'.@.Nw.U|.."9...P.S..,......1.R.."...V.........hwY.3rW6.. ..8s.u3..$.?p.S..............N.:...p.....S...].|..f.....Q.h.k..FY..'0...L.\.g.Z.....0.....7...2.k....\6.X.%%21W.v.1T....[./..M ....m.JE(T.M.7..B...Gp...R...k....n.l......w....(....Rz.M..tR.t`F..5.*........=..f.W..YV..,. L.K...l.@TZ.'.Z.P{...v..O~../_...c.

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{F516CCD1-4C54-4463-8E8E-043BDEA297D3}.tmp\defaultskin.ui

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):190105
                                                                                                                                                                                      Entropy (8bit):7.876379680368982
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:kjlj50A/p9fDAY4Pz3veaFjrJXo7blC47kbYKTaTZV22DhCF0dys:+jL/p9fDAjrvxnJXKlCY3TZV2C+0dys
                                                                                                                                                                                      MD5:B34EBD51C6492553F37E11A38861416A
                                                                                                                                                                                      SHA1:1EB4405C0B03EB9611F5C0AECEBB63CC571543E3
                                                                                                                                                                                      SHA-256:532B0D95829BF64F065F76CBE8F98B698C81E53AB9595083C946373E712E3F05
                                                                                                                                                                                      SHA-512:F3D33303D60BE93366AC337A6CB17DE6EA6A5E2749DB6A1989298497EC631E80997438D6D2F5FA44850513BD48BF2D23AD2B3F95C89D65F608A6EEEDC608BE7E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK........F..B................Common/PK.........Z.A...............Common/360Safe-16new.png.PNG........IHDR.............(-.S...:PLTE..............2..3.#:.#9..$..........4L4M...>,?n$6_.!K1F{.|)."L%7d...&7`."K......!I.q...<%7c$6^...1G{5N......,@m&7a.......(I.a..../..:#.....D.B..N....)K........v..1..AYe.,8X%2Q`m........7bo..a-.....6....0.......+H~.;.."dr.....K...j.hu.(..!.....et.gu.hv...mz.Lam.;KpP..<Jo....%A..6.e$......hu.....{....&..gu....T.._.V..X..6Dgl.....w.......o.........|..%@.%@]..gt./...{.........].....[..`............/=_Q.....K...........@c.......Z......H.....'D.......)6U.G..3.c%.d...%1N..x..[....l.....m~...;...@u.......................$4Z%8e"2V!0Sfs..%A.&B.........L....tRNS9.9.....;53.X.7.....IDATx.].e;.a....c....t..tNwww.t.4c......y...x..>]......\..hk,.+....0............tAx$Tt-l.g'...Z:.2b..g..].......:.V/O^.0........8.:..$.....\.H.IxY......./.>...~.....X.......f..S..0..^..@......py.....f..C....ml9.Nn..I...R.Y.....\..J........mg.....:...@...

                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{F516CCD1-4C54-4463-8E8E-043BDEA297D3}.tmp\miniui.xml

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (586), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):3972
                                                                                                                                                                                      Entropy (8bit):3.7261411544758056
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:uqaDiDjTHCIDm8Scc0LoSd8jVcxsuwScd0+807deAYRgP8:8uLJDLo7VEb
                                                                                                                                                                                      MD5:D28462B570A9BE65DFF946528F7FC699
                                                                                                                                                                                      SHA1:1F295641F06569F225A5E73D24E4C7F26144E371
                                                                                                                                                                                      SHA-256:ED9C12AA4079376C8E2037D8563F7B04CC3829094D5FE87F83831249FED64F96
                                                                                                                                                                                      SHA-512:E656E4DE29A4910BE95714C317C5943B4B21FE2BB79EC3FC54A81B74F8664E5E3D22059610B24EC9BDA97CE663792E25CAEE9A92D44193B796E88D5859D253F4
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=."..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=."..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .M.a.x.i.m.i.z.e.B.

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\AppBreathLight.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):4.039547553742004
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Y/PovdOfVK5eR3JIv:2gOfY5eR3Sv
                                                                                                                                                                                      MD5:0C9F3D94ED33FDA1556FB21BB25EE76C
                                                                                                                                                                                      SHA1:2010F3411E723FDEB7CF7B0D20ADF3AF36BEBAE1
                                                                                                                                                                                      SHA-256:740637A7D3C3ECDB64BA259EB511D441A7874EFAC157C6B713BD12223671EAAC
                                                                                                                                                                                      SHA-512:9EBBD2BDFEEA7A1A9BD0B5D07A5FECA0252BBC26960DE058DFA9C899CBD06ABCAE3A1DFB24FD1BC20F260521C6604121768C6F3F0C3BDC4B7FCDB63A43D414BF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[flashapp]..counts=0..app0=40000094..show0=1..

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\DtWebmailHost.nxdb (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4664
                                                                                                                                                                                      Entropy (8bit):7.9024371353906995
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:HNZ3S1pcXvEncKIMc9aInOmBcbx6xU+jC1cF7cfCL73UKhnhjT4K+dVj/bjnn:H7Kpc/EncdMc9aMNcbx4gclcfK3Phhsn
                                                                                                                                                                                      MD5:7461A7E4722BA49E750E80F26063BF0F
                                                                                                                                                                                      SHA1:75EAEE2D5E0C1E111429362727A1973E2F2122DA
                                                                                                                                                                                      SHA-256:C228233D9D01A25BEE6385BB12674D7252173E1FEC7B11F0C0B04A654C6849D8
                                                                                                                                                                                      SHA-512:F43880DEA01E2638B9AE65180BFEB4611DE206C1118220EBB64F649E1889E40BAD4A45A8C5DB66CA502F459F11E709FBC877C8AC95459329E14FDAEDEDF1BAC2
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..E.O8p....]3=....e.....P.-&..T,"..>?(.G...K1.N.3Aj%.y7..+...V.....%..../.....B......K.".iI....i..`....c.,..&).>...%Ue..sJ.X..l[.(t.k......x..m5.~..{iz(...`j.:..VNi.3R"4H~.j.g.V04$...f.f7...'f..^D..'..]w.N.....nL...x..?.....=.WG.....AE[`.k..Q.7x...@%x..wq..g.K..r.=....7.5T...n.i.8....B......E.....z...y....[...).(!...[!.K..+..C.4&.I....5...N.E...b........(.<x.V.K.Qi.Lo..&.0h.vkBlI.Sg....n....|.3b.^3.:.9..e._.d..W`f.<.l....h0y...k.BZ..S....}(M....{. .....;....nf...........z.:..c.ALA..6....'...M.........Bim9K.0.lV...#........UP.;ViJ..ko....v.11.}...az..].iz(...`j.:..VNi.,.m....7....Ha.S....;..f.#u..[.s..!.L.>]\._..Y_..,...n..D.6..@9..e._.d....R.G...lc..|y...k.BZ..S....}(M....{. .........."kn<E8n...`.TO..R.....>.."1.'...Bim9K.0.lV...#........UP.;ViJ...X/..-F..0.WL8.L.O|6+....;..f.gE.1gS....QY..........%...^..5.x.D....}.uG...qq1Oy.Z.pO..w...7..o'...\...D..#VI.7..m....@...).k:.%..._v.,.....f.HG..E.*.......u...!..h..#'.X...M....y

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\LoginAlertSwitcher.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):35
                                                                                                                                                                                      Entropy (8bit):4.557854445516394
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:pfxMMQJoqEuJz:RxMxdEuF
                                                                                                                                                                                      MD5:84409A8BC95FED35DDFA7EB07326772C
                                                                                                                                                                                      SHA1:1D3C7402E41E21AA16F3215DFEC703F05901E615
                                                                                                                                                                                      SHA-256:4EE71F6337AAC0BDC8E9271FDB5211F1D4D47B62E0D64BBABDEF2EC3EAB82A5E
                                                                                                                                                                                      SHA-512:EACC720369B663CD58551ADAB67A9F01509466DF108C33CC85A32C8A134031482EB25DC22F3547C54D5003E3E9A25B689C30C2D68FD0980CED20F65620443871
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[360DT_LoginAlert]..GlobalEnabled=0

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\MiniAppdata.xdb (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2293, database pages 15, cookie 0x1d, schema 1, UTF-8, version-valid-for 2293
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):15360
                                                                                                                                                                                      Entropy (8bit):2.8124072000918834
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:z17Fs4cY8+PKgH7cKXJ8k4/FaL/9EKghOFJO2gU:z17FsxYKgHgKpIFa7yKg0JV
                                                                                                                                                                                      MD5:848E2C1F7B26A733D26D2F16CE8859B3
                                                                                                                                                                                      SHA1:88D56A5FDE8C5437F762D477E88AE5BA19C85649
                                                                                                                                                                                      SHA-256:BD4A9D5350B7115E9D07F810B2B2287FDBDF6D43D3EAD8F569B685224DF1A899
                                                                                                                                                                                      SHA-512:635661CEC0A871F9F9FAE2ADFF5A8E6314122DD88E96279484309710B196A37854DDFEF112CC8ED627DE3B3E28A79C1A8AE5E536D043477980E302772F2940FA
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:SQLite format 3......@ .........................................................................-.................-...}....................................................A...U/..indexsqlite_autoindex_recommandappinfos_1recommandappinfos..G...55..1tablecustomcategoryappmapcustomcategoryappmap.CREATE TABLE customcategoryappmap(aid INT, cid INT, extratext TEXT DEFAULT '', extraint1 INT DEFAULT 0, extraint2 INT DEFAULT 0, PRIMARY KEY(aid))G...[5..indexsqlite_autoindex_customcategoryappmap_1customcategoryappmap.y...33...tablecustomcategoryinfoscustomcategoryinfos.CREATE TABLE customcategoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))E...Y3..indexsqlite_autoindex_customcategoryinfos_1customcategoryinfos.g...''...tablecategoryinfoscategoryinfos.CREATE TABLE categoryinfos(cid INT, info TEXT, PRIMARY KEY(cid))9...M'..indexsqlite_autoindex_categoryinfos_1categoryinfos.a........tableappinfosappinfos.CREATE TABLE appinfos(aid INT, cid INT, info TEXT, PRIMARY KEY(aid))/...C...indexsqlite_autoindex

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\SelectMusicConfig.xml (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (331), with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                      Entropy (8bit):5.61945157091621
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Jd5v5t74pCBcvAqRCKt74GjsZTVsRQnzCR9Pt74QdK7GseFCr4t74ds7WIagI:35vf/yBCemZemzCRD3c7uFCrQ2s7WkI
                                                                                                                                                                                      MD5:0709F9A3CAEB77E0B08A43ED59B0B4F7
                                                                                                                                                                                      SHA1:243E2710090DAA3A328FEAE7687B07B4859C6E42
                                                                                                                                                                                      SHA-256:CD0EA12B9F90FF34820E628011FC35B7092E5F0BF087A02ACBE85D6DC150E31F
                                                                                                                                                                                      SHA-512:7580247D55B8D623C61D6243FE8DFFBD3DD1B418EF7C5E1A9259EB6CAB47B526BED8CA08F551236D39ABAA617F3A5C7696C1331470987AB4230A48F9507DF65A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8"?>..<MusicPlayer>...<player playername="...." version="1" playerid="1" listwidth="420" listheight="622" playerintroduction="........" playerlogo="kuwo.png" titleimage="kuwotitle.png" data_path_name="kuwo" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kuwoo.zip" player_html_url="html\main.html"/>...<player playername="...." version="3" playerid="2" listwidth="310" listheight="622" playerintroduction="................" playerlogo="kugou.png" titleimage="kugoutitle.png" data_path_name="kugou" player_down_url="pdown://h3=30|k=1|c1=0|http://swf.baoku.360.cn/zhuomian/player/v2/kugou0329.zip" player_html_url="html\index.html"/>...<player playername="..FM" version="1" playerid="3" listwidth="560" listheight="622" playerintroduction="..........." playerlogo="douban.png" titleimage="doubantitle.png" data_path_name="douban" player_do

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\douban\douban.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):5144
                                                                                                                                                                                      Entropy (8bit):7.924303008935322
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:96:jSMllcHitlIxv9vk7C1+I4wWHLihk/x/XRzAd/7rtYWcuS4TV/zoCQG:jSHIIHUCD4wanAdvti4TWC7
                                                                                                                                                                                      MD5:278C49FB3BC908F88B2FCF0C59A3EFA4
                                                                                                                                                                                      SHA1:4DAF8D31656B057973261DA592D210486B2A5E63
                                                                                                                                                                                      SHA-256:64AC53712D212CA020E4FC8D5DCBC262AEEA36084647079D0B3F9826BC0D1BB9
                                                                                                                                                                                      SHA-512:623266DBDE05F850F99B8AB31239CF2183B620079D8E5D1CC193EFABEE527192BFFE90C3EC4CD2C96483AEA64E7A5F3A4DFBD98C35556BF254659FF17A2C57E9
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\jingfm\jingfm.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):7971
                                                                                                                                                                                      Entropy (8bit):7.956521088757676
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wauVFxHUELpeNDF8pW+ZYibvAmX:W50wzbxHpeGb/b
                                                                                                                                                                                      MD5:E670AB623C433324324FEC4B53DAB011
                                                                                                                                                                                      SHA1:82D79DCAE81F58EABD8EF76C17EC6057F13BD9D8
                                                                                                                                                                                      SHA-256:880D829FC1F50EBFD4567F21D190966BB6283C03D5ABEA5C05753DD73726BF6F
                                                                                                                                                                                      SHA-512:E206D1D4BFE38D2000AADB54E797F192A4DC364C24F53972D6FD64F975C6B68E01F85DD2BA3EE173061BFB02955231D9801362CAA729B8B15DB8EFA73391D8D3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\kugou\kugou.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8086
                                                                                                                                                                                      Entropy (8bit):7.96318899322068
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4wakANE0zB4bPD3FX2Xa+AjGLf+ZBHq:W50wZAN7qr/jGLfCBHq
                                                                                                                                                                                      MD5:1752E6A102C825F40CAC0102CA4389D3
                                                                                                                                                                                      SHA1:FEA1008EE4EBC636C20AA6E78145802F498FA4BD
                                                                                                                                                                                      SHA-256:5A44CAEDAE5C4FBAAB8AF9FC71B320E2F85ACB879420DF4C4962D87226E8F7EC
                                                                                                                                                                                      SHA-512:C436B3AEE7107478C93ECDC8FAA941F43DD830CC492073803D9420D91B0C1C077B437423E2A013DC46D11A26A549EC2751E903882097A54FAD4E82542D1BF036
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\Music\kuwo\kuwo.png (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):8115
                                                                                                                                                                                      Entropy (8bit):7.965265564609039
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:192:jSHIIHUCD4waeV8OpYHbC8iBo7IDEeENYwWLTzmakArjP:W50wj9u8qIDEeENYZHvZ7
                                                                                                                                                                                      MD5:440543B6F1CC1F444E6A5FE8E5247D09
                                                                                                                                                                                      SHA1:0C3E16121D76EFDE609E48C571D90F711F84AB9B
                                                                                                                                                                                      SHA-256:7EDDECC40D5206764122F3C5632DDA068FF6E20F8C2C043B3B596E9D69FF6507
                                                                                                                                                                                      SHA-512:3EC7D77984AD04FB16ECADD83F0295CCDC1CB762C2C5877DEEE25D5CB1F32139C306ADF7A6D7D706F694A3AB9FEBF0E4E8500E2D7E8F9DE27ECC915C18EA61CC
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:.PNG........IHDR...6...6......Ej.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\WallPaper.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                      Entropy (8bit):4.679315715874588
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1AzuUv2mK3sxXpEWXMXvK2mMXeVI/TI:Kzz00EWivKZVl
                                                                                                                                                                                      MD5:38CDC5178E49F594FC807CCDCDE640FA
                                                                                                                                                                                      SHA1:71A02D79F40A2E97C23AF28952294A46AB695ED4
                                                                                                                                                                                      SHA-256:8289933C11E8FE82CE16191AC4D5718ADC915C0990A1569C686D7541DAC53FAF
                                                                                                                                                                                      SHA-512:9DB956A91CAA1877528062495A129C6378296B7B5E94D25DDDDEC81B8CB208B65954A3826CA4666E2A3819F7429A2853A8FC4F2B459472FDD41852E64E845607
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[WallPaper]..Switch=1..TipShowCount=0..TipShowLastTime=0..TipShowCircleTime=86400..

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\bak\Config.nxdb (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:data
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):290
                                                                                                                                                                                      Entropy (8bit):4.645472736563747
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6:TMVBdxdaT0x3OY0FgU3OY00mxFxpyRdL1Li3OY9WhblIW5:TMHdxdaToYgUHmxPudpLisZIW
                                                                                                                                                                                      MD5:D4C64B72909AC4E1A9D967BAB4CBEBCE
                                                                                                                                                                                      SHA1:C9E6212F312A0084112B8E909EEF04C28FD3C81A
                                                                                                                                                                                      SHA-256:8ECCCE53B3E4F3A052D15C40391B883AEB5ED3B0F17750FC131D19A57EC6FDF0
                                                                                                                                                                                      SHA-512:E260F51650C704BB8869CE0D4739F00C4D9EA53E14F58678E7760F0B0F930E8584162CE3C1851E100C3C8376656B459ABA71E8204ED4AC362A80BE24A91DF0C3
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" ?>.<configs>. <SEG sn="SettingCenter">. <ITEM k="14" v="3" />. <ITEM k="15" v="3" />. </SEG>. <SEG sn="FavItems">. <ARRAY k="ItemArray">. </ARRAY>. <ITEM k="NoImport" v="1" />. </SEG>.</configs>............

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\extensions\LoginAssis\app_stat.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [SUM]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                      Entropy (8bit):4.268954494309836
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:B4aEQuEoB6FFT9HvWyUiWEO:O446FFpr5O
                                                                                                                                                                                      MD5:3E53339ECDD547A741F506869DCD3C58
                                                                                                                                                                                      SHA1:9DCA4309F1550AD706670E5EC0E462FE5D0261C4
                                                                                                                                                                                      SHA-256:E612D6B62B8987BDDB52A6E0C0AE9994CA943191440FB4D98AB78CE24CAAFD7C
                                                                                                                                                                                      SHA-512:9C431D2E017CBE89B451867CC16EA8AF49880B6AFF2B98CB0BCF1AD308C9450939636107A00AE8D33495813811B16241C5F4BDBFB63D6CBAC683F723D4D9B3FF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[MAIN]..lastday=1340244980..[SUM]..s20=9..s25=12..s0=12..s21=3..

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\extensions\LoginAssis\loginassis.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Generic INItialization configuration [change]
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):154
                                                                                                                                                                                      Entropy (8bit):4.109828175983949
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:1/KyrCsCOEYoZOHlRKCOGYVojOB4yrOAYsECODFOCY0KEoxJokn:1Ves/xoYHW/PVoCB4p9X/Dcb0KBVn
                                                                                                                                                                                      MD5:33DDFE739BFC342FAC8365174A8B95B7
                                                                                                                                                                                      SHA1:000D20215C864DFE8DF60EFAE32F2E95BA1335BB
                                                                                                                                                                                      SHA-256:AF6F08A6DEAF754A27A9C78ADD7B01E27C3806E9F8D02EA6FA9541B7058D132A
                                                                                                                                                                                      SHA-512:18E9B2CA077A2E6EBC207B4103D90DD42C946944A232EBD8764CFB3A51D9909E5E4272918F18E919476B0830CC3811AA39CE17FF0A71560E72D22967EE86C1D6
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..loginclose=0..loginerror1=0..loginerror2=0..loginerror3=0..loginerror4=0..loginerror5=0..loginerror6=0..loginerror7=0..pop=2..[change]..domain=1..

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\extensions\LoginAssis\update.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                      Entropy (8bit):4.472574792228983
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:19lpDA5RvPv:19QHv
                                                                                                                                                                                      MD5:C957473AE3334BAEC2906A46F9F5C995
                                                                                                                                                                                      SHA1:B8AA6451DEBD98165B051BC4405CF50052EEDD94
                                                                                                                                                                                      SHA-256:98C2CC603C3055DA75F2422E93C54872B20F00F68619FF6A787D347415D42645
                                                                                                                                                                                      SHA-512:1B1A35CE1C7F15E7B20608AEA7BD124A64E0935418600A8630EBB3B285F802515B1DC306905FCA13D3D6139373CB4676A941D702F6EDD93C6ECAE3959D4E5ACF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[main]..netsetting_lastupdate=1334736582..

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Desktop\import.fg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):78
                                                                                                                                                                                      Entropy (8bit):4.367903661777143
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:L58BhYUyC2MYRAQHX5ov:uMUyCrYeQHX2v
                                                                                                                                                                                      MD5:6484C6AC89C6DD619A9B1E613C77E66D
                                                                                                                                                                                      SHA1:6462D4DCCA4ACC69CA0BF40C31AF4AF68F3BF29B
                                                                                                                                                                                      SHA-256:1FA27708E6D3FFAE9C1090ABDD4C3514C1233008A66D94568F3A3E9E559EC1EB
                                                                                                                                                                                      SHA-512:F5E4CB990E5F3BE1918BEB7056BA831C1C200E4D0B351224D28E4DAB23D3D279188573E3309F95333F25B56D4D701B7DE70FB2702558356055DD45230E8ED61F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:[import]..version_opr=2..fullscreen=1..system=3..runpreview=1..shownewuser=1..

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360GameUsers\snap.jpg

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 968x594, components 3
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):260245
                                                                                                                                                                                      Entropy (8bit):7.981838538263462
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:CXWH3fo3RWew5+WSY0+VdrQdRFsV+6jRqOQIYNe:CXkfGMew4W3jfrQQj97
                                                                                                                                                                                      MD5:F6131F2C0C5DDD7849ACF29C8A5E5549
                                                                                                                                                                                      SHA1:AFE63A494D32467FF49EE213A1C36DF2C2769074
                                                                                                                                                                                      SHA-256:A4AC0C0ECB65A6086391EFBC8A4B50B621A13ED1C1E1B8D7395EF54CCBFA6988
                                                                                                                                                                                      SHA-512:6A6E04F477B5E6844042BFDEFCAFA7680672F45B512BFA6BA7687C8A95EC1E3FC91C0BEE9726F866BCC85133DC110BCFBCBEA2E7EBE3AED5BDA76C26E54400BE
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................R...............................................o...........................!1..AQ."a..2q.....#BRSrs....$345Ue......6CTVbt..%.........&78Dcv....u..FG.'W.Edf....................................R......................!...1AQ.."aq..2.....BR...#3b......STr..$45d...Cs%.Dc..&6..............?.....mf......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HD..E.9.M..>.)Za.vV.:.ZB.>.[z9F:.u.........m.....~.O.....'...g.5..,....M...Ne..l..H.p...Z_..3..}...v?i.4.s/.g.].G..........,....M.....?..?\6......4...Af...o.>......|...'...g.4..0..~.~i.._....4..........k....CNGq~........n...s.G.T.>g..E'..}.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m!...HDo.......F..m

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):4405112
                                                                                                                                                                                      Entropy (8bit):6.54104069780479
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:kZoX2uGyQPd38V3ScT44Q6SrRaVWiXk+NolDH8k1VbAxwhvcL5b+xal50+pTRT3q:WndPd38VCON0+rk1Vbm5bEA0+7qf
                                                                                                                                                                                      MD5:F1C9C0C1425BBCCF47C1AFB1302F59FF
                                                                                                                                                                                      SHA1:24A0CE9D29449164B50F7C8B6BB50F130762A467
                                                                                                                                                                                      SHA-256:073FD886ABC9132482C8B9B944473C08CEB8604187BBA3A5E4DAC0221C4C383C
                                                                                                                                                                                      SHA-512:CE7E415A3ECAB14F3747D51C9619700D65141E3349C5E56E937D0A16BB6FECF2FA5295B3ACA95AAF9AAA954877CB422C5BE8A955E3FD2D8171736BD050AAA332
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...yn.P.................$8.........X38......@8...@...........................J.......D..........@....................<......p<..I....A.............."C.x...}.J...............................<......................................................text.....7.......7................. ..`.itext...(....8..*....7............. ..`.data........@8......(8.............@....bss..........9.......9..................idata...I...p<..J....9.............@....didata.......<.......9.............@....edata........<.......9.............@..@.tls..........<.......:..................rdata........<.......:.............@..@.reloc.. .....=.......:..................rsrc.........A.......:.............@..@QProtect.0....I..$....A............. ...................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\360seNotify.rs (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):695672
                                                                                                                                                                                      Entropy (8bit):7.872174101935894
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:9iqXVf+i83kCL4fa4gfL4fa4gfyAb7QvzAuA1UmLpflEddb8b:kqXVl8nyAbUvMuA1UmBWD8b
                                                                                                                                                                                      MD5:AFCE1572F712D14924A54D6C6D85A253
                                                                                                                                                                                      SHA1:DC5D68D5F32CAF04F88875AA69AB3F0B62239513
                                                                                                                                                                                      SHA-256:A7D817E4CC497496E98CF1463A0E490ECB0DFB83BEB9E2B21A23DA911D75F699
                                                                                                                                                                                      SHA-512:25F611690B8133ACFEA262A902B76843AD0753599503D45232D02946ED0248A7CEE8A39C772853E512004AA93C3E657BF9D8B66D26BB36AD19011875DDBF7F4F
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....ZP.................8...L.......P.......`....@..................................2...................................................:..............x...........................................................................................text....4.......6.................. ..`.itext.......P.......:.............. ..`.data........`.......<..............@....bss....|+...p.......D...................idata...............D..............@....reloc...............H..............@..B.rsrc....:.......:...N..............@..@....................................@..@................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\360weibo.exe (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):2473320
                                                                                                                                                                                      Entropy (8bit):7.170882557492812
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:JrUM+KjQptQubmeGTU9taTqvyG0F/n2umcetnHaR:JKtQkmGc2Rcv
                                                                                                                                                                                      MD5:207187DA1CFD94F8D927A6D6094A33AF
                                                                                                                                                                                      SHA1:2BBCD15B440101F5781DB5F5178CEF8C0232CE3C
                                                                                                                                                                                      SHA-256:BE964FA9736D7BDAD0C950FFF371197574A7081F488A884605C17010689CF877
                                                                                                                                                                                      SHA-512:E3F32CA9805AE7267C399DEDC784E6A76A1A282A686490D02A32FFD39A719EDB49A3E07F7079709140A1EF3A21042267266A2D1F971881AC514D142F69D646AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D).t.H.'.H.'.H.''..'.H.''..'.H.''..'+H.'.H.'.J.'.0-'.H.'.0;'.H.'.0<'.H.'..<'.H.'.02'KH.'..,'.H.'.H/'.H.'.0)'.H.'Rich.H.'........................PE..L....."Q..........................................@..........................0&.......&...@...........................................................%.h.....$.4...0...............................h...@.......................@....................text...P........................... ..`.rdata..fL.......N..................@..@.data........@...`...*..............@....share..............................@....rsrc...............................@..@.reloc...n....$..p...:$.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\ExtNetIncrement.dll (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):285048
                                                                                                                                                                                      Entropy (8bit):6.492512091199515
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:As8yZny7jGBbSLPdSP3JBI6jsR8Pym0OSahuJ+:zy7SBb+dSP3JBI6o8qm0O/EJ+
                                                                                                                                                                                      MD5:39E18F0F619546380688A92AF44D654B
                                                                                                                                                                                      SHA1:76D6E5065F188EA287D00BEB8B2C38C4F9631038
                                                                                                                                                                                      SHA-256:3C2FFF93C150BB229FF1B71E8720CC18DEB9B69B1A0FCBFBE691256EFF3DEE92
                                                                                                                                                                                      SHA-512:B53339E2C940A38020C48F3F9FD3925168CD7ABFB6B974A4E80FB4762FA8A9A028638FC0D904F4A8D0065F50C0CE9672CEC3D945C9B5146CC8D13B7C712C157D
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$..VE.HVE.HVE.H_=WHLE.H_=AH.E.Hq..HAE.HVE.H.E.H_=FH>E.H_=PHWE.HH.VHWE.H_=SHWE.HRichVE.H........PE..L....#`P...........!.....T..................p...............................@......................................@.......T........................D..x........!...s.............................. ...@............p...............................text....R.......T.................. ..`.rdata.......p.......X..............@..@.data... ...........................@....rsrc...............................@..@.reloc..:D.......F..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\defaultskin.zip (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):89232
                                                                                                                                                                                      Entropy (8bit):7.804803823752292
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:y55kBo8le0jvUXLH7STim62VC1A58PblX1XzJxUn5ucRGcZRX4:y55kBoDeI/STBB2A0x1jJxu5VRGcZV4
                                                                                                                                                                                      MD5:0AB8A06150CBB0561E907976715CB447
                                                                                                                                                                                      SHA1:71ACEACA41CDB176D9E6CCE7856B44A3D39C573D
                                                                                                                                                                                      SHA-256:F160C8EFA5A2D1F42216403DB162BF0F205C716A5FB96522D1A573C28031191D
                                                                                                                                                                                      SHA-512:D5D787AAF97E764BB7EE226CE33EC765C308D27BC4FC4F18EE3A9A3BFD766E964D052BE854B1F418340E4657DB858AD5EA950DEB6C37A9FCDA70A3667E43CF8A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:PK...........A................default/PK...........A................default/add_link/PK.........aA...x............default/add_link/bk.png.T{8.{..Q3,M....Q.....!...}n-Ns'IL.$....g...!..en..Sn1+....4.5#.vv.8......}>.....}...&.,.$.%...B^3w...7..,.&.?[f...x:....~......].\.c..../U8`...[.6-.8%..q.9......C.#....yQ}......X.=.^.D.IIDT..s...(6u...t.!....l.......f....3..U.a.bq.Y...5....._Q..}b?.]....6sZ..++.^...F.........*V3....t.c./..?}R...9..H.<H1B ...'&..X.....G.U.Z_Jc.>.._.k&.$$$\v.\.g1.cOxe^......{-tF..@.1,[...D....,l......+p.J.r.]z.....sS,=..Z..`.^FCQ....&".........}..F4.....?..i.Z. .... 'E...s.....0.#...Q....(..........v.....F..e0<.T8p....q;.$\...L...u~.]x...4z/J%./.\_4..#Dz.?S...\.M.4@.O!9'....K.G.9zYZ...?.....-...O...i..Bah'..YvR..e n.;#C.K.pTck..{U.....7...j.;..4`%.....<........$D...".f.....2@q.Gh...3Y@.G.r...P.}...N..T>..F.i..).........<6..>z..U.QC.Lw].9....,.!l.y......k;{...w)s..\.]s/jD.f}.....3........'Hb.e.....W.Kp-T\...Z .s..?.KT.r.B....

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\language\2052.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1592
                                                                                                                                                                                      Entropy (8bit):5.57984884030076
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:Q+jUY4lo0tGhjg4URnvJgCWaiJm1Nob6AdtT4si2OaaNoq26AdtuQyskB0uPTn0O:rjyosGhMhRnSCM6g472F6DMcvTn0O
                                                                                                                                                                                      MD5:A4CAC1232C683C6F12FE77D7F18E8982
                                                                                                                                                                                      SHA1:ABCB5A0E26260EEBC4A24753496358E0D6CC2BD2
                                                                                                                                                                                      SHA-256:F6D12D2742F2CAE90B9CC1EB2A51C81F793EAED9B6E3E18439F00EC74F1C7D9A
                                                                                                                                                                                      SHA-512:5DF6850EB4AE88F6C137FF33591DF74DBBF921C65A87A416031D5CBAA332217CEAEE45EEC7D7373A511D1BC80FD9E414DC87881C82576E82B654E98D72530443
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.a.p.p.].....N.A.M.E.=..mo`.vP[....L.A.N.G.U.A.G.E.=..{SO-N.e........[.M.A.I.N.].....1.=..`(u@..c0R............[.L.O.G.I.N.].....2.=..R}.-N..........3.=..f.e.e.l..c.N.g.RhV.....z.T..........[.B.U.D.D.Y._.L.I.S.T.].....1.=.._ZS}Y.S....2.=..b.vsQ.l........[.F.O.C.U.S._.L.I.S.T.].....1.=.@b.g.R.~....2.=....R}.-N................[.C.H.A.T.].....1.=..S...Q.[.N..:Nzz........[.W.E.I.B.O.].....3.=.#...(W....eQ.[IN...#.....2.0.=..b.v..u.....2.1.=..b.v._ZS....2.2.=.@..c0R.b.v....2.3.=.6e0R.v.......2.4.=..b.v6e.........[.M.A.I.N._.T.A.B.].....1.=.._ZS....2.=.@..b....3.=........4.=..y.O....6.=.sQ.l........[.I.D.D._.S.E.N.D._.R.E.C.O.M.M.E.N.D.].....1.=........2.=.l..S....6.=..S..1Y%....N...S.^..Y.v.Q.[....7.=..S.^1Y%......z.T.Q.....9.=..S.^.Q.[.N..:Nzz....1.0.=..Q.[*Y.....N.....1.4.0.*NW[&{....1.1.=.l..S._ZS........[.I.D.D._.S.E.N.D._.W.E.I.B.O.].....1.=..S.^.e._ZS....2.=..VGr....4.=..N/e.c.v.V.P<h._...N/e.cJ.P.G..0G.I.F..0P.N.G..VGr....5.=..N O.v.V.P._{..\.N5.M.b.....6.=..S..1Y%.

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\language\current.ini (copy)

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                      Entropy (8bit):3.070031888400838
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3:Q+elPVtClLtlElQalGn:Q+elqlxeldGn
                                                                                                                                                                                      MD5:D45E9DDBE56A1DD7B58BD733BFE482B5
                                                                                                                                                                                      SHA1:2C83B4D3CB08F08D1C3545FF50AE14F0B49A58DB
                                                                                                                                                                                      SHA-256:52989F602299162773D8814D10C6A5A45FA86B4BDADF7295FFBA816AFE04CD32
                                                                                                                                                                                      SHA-512:D24A4D96458E103B51F5A23DE3528DBA1BA216692870B1E4B41625BB0D7EFBAAEA5B8BC2A90E6CE25C14408F2B90A0EADDEEF45356E1EDB07A964AC04818F87A
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:..[.a.p.p.].....l.a.n.g.u.a.g.e.=.2.0.5.2.....

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360Notify\Bin\sqlite3.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):423584
                                                                                                                                                                                      Entropy (8bit):6.683424538324543
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:12288:Yz0fZUselMRqlkPUyZWTQHkK67VTZ6pGBdmkRL6iH3/BoqnuF:hSyZC7WpGBdmkRL6ipo+uF
                                                                                                                                                                                      MD5:4D1B78591D892A54DD795AD3F7336756
                                                                                                                                                                                      SHA1:7935FB2758003BB3BBE9C58811DB71323FD66353
                                                                                                                                                                                      SHA-256:2938CCE7F5716AF3D6317D1617DD3B2E8C212A11FD91DE95AE0713D8E2FFE0C2
                                                                                                                                                                                      SHA-512:17A5D93430A39F55CFFBD892B89560710B082555D714EE629C5E399B386B3F5A30F6C47E202E3E3FE8637DDEFE2C98D0CABF8DD67D10A0555719A6F765129052
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.?..kQ..kQ..kQ..w_..kQ.yt[..kQ.ytU..kQ..c...kQ..kP.TkQ. M[.YkQ. MZ..kQ..mW..kQ..KU..kQ.Rich.kQ.........................PE..L...k..L...........!.....0... ......)7.......@...............................`......8&...............................|..W...Xw..<....0..`............`.......@.......A...............................................@...............................text...6(.......0.................. ..`.rdata..GS...@...`...@..............@..@.data..............................@....rsrc...`....0.......0..............@..@.reloc.......@... ...@..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360verify.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95752
                                                                                                                                                                                      Entropy (8bit):5.3432706015800395
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:GXyknjsQo/dC9bL6TU9bebbXJtualk8mkIGqj8n46:3knj9o/W346aluQqj8n/
                                                                                                                                                                                      MD5:9468D919B3A6D024113D3664698AE17D
                                                                                                                                                                                      SHA1:D5D24F3D49678FB2158440E6237036031444BC32
                                                                                                                                                                                      SHA-256:F0658FA84ADA335776D5936C5FC6FDAD95F40EE0C7B4B1FAA3AF61E848D9697A
                                                                                                                                                                                      SHA-512:81745EB8DA3BD4F3D276504838F29B573E217F9A6550D2B50A7FF116B22334BF042ABC6D1F0FBF1135ABC6276E819A91069B7E81CA9621ED9F34B838E95DB55E
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G..t)..t)..t).]|v..t).]h'..t)..R#..t).$W0..t).]|t..t)..t(..t)..R"..t)..r/..t).!T-..t).Rich.t).........PE..L.....I...........!.................E..............................................w...............................p................P...............`.......`..@.......................................................|............................text.............................. ..`.rdata..Y........ ..................@..@.data...l^.......@..................@....rsrc........P.......0..............@..@.reloc.......`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360wpapp.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1664832
                                                                                                                                                                                      Entropy (8bit):7.192460037805412
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:49152:pM8PwZX6D3RzFN2r5lkVEhRPT0I9J5MQPQExTLILmebfiG/USK8:pMgwsDdFw0VEhRXtT0KqfHD
                                                                                                                                                                                      MD5:F9093B9504ABF8EE62BAF4B74D665841
                                                                                                                                                                                      SHA1:15C04D62174A543070B3CDE000426FB82E053CF8
                                                                                                                                                                                      SHA-256:AB4A4927295D2095458975046109896E03BECADEB62C106C13C734AB2A310022
                                                                                                                                                                                      SHA-512:D958F581E5CBF9CD59205961A0AC30F96C2656FA0E625D986F6BEAD9D1E617D002019892FA465425290CF0DF5E508A31CF6FBBDCDBA6C4B63F5D4A61B7688130
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......V..H.u...u...u...j...u...:W..u....T..u..5....u...'E..u....B..u..5....u..5...9u...u..Gw....H.Wu....E..u...'U..u...uV..u....P..u..Rich.u..........................PE..L... ;.Q.................>...........U.......P....@.......................... ............@.................................4w...........,...........H..@....0.....0Z...............................................P..(............................text....<.......>.................. ..`.rdata..LS...P...T...B..............@..@.data....K..........................@....rsrc....,...........0..............@..@.reloc.......0.......^..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360wpsrv.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):947888
                                                                                                                                                                                      Entropy (8bit):7.05706684193467
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24576:rXl7stOdRZQ4qrLZcycP1N/qTDUvSfiG/US:rXl7pbZKLZc9byTDU6fiG/US
                                                                                                                                                                                      MD5:B8B17E96DFCB39621A7D886528D1FACC
                                                                                                                                                                                      SHA1:BAC017451A2BCEB5EC5D4539ADE65AA718551D7F
                                                                                                                                                                                      SHA-256:91F4A07C32C066C53017A35E382DAD5CB275669BEAC3C61A59FB767509D165F9
                                                                                                                                                                                      SHA-512:EF988EA23B5142FE6C6BC51A444F637B194DF44B939055DDB191FAF9D2821E29F0AA3CEFA03EB6C474B678A3BFB67E699D4BCAA3B3811BF37CCD7A1EF8CC33AF
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......d...hfq.l....Qn.b...hfm.....hf{.....F..`...F..d...F..F...a......hf|......Ll.`...a.o.`...hfi.`...Richa...................PE..L.....Q..........................................@..................................5...............................................................\..................................................................l............................text...@........................... ..`.rdata..T...........................@..@.data........P...X...4..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\360wpup.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):179352
                                                                                                                                                                                      Entropy (8bit):6.124363877722988
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:GFwjHa+W0z9WL2kl8/I3TRGX5FVXh5HnpIx7oY:cwzagIL2kig3UXlnpksY
                                                                                                                                                                                      MD5:7D5ED86FEFE3D5432EBE6EAE3D7674F0
                                                                                                                                                                                      SHA1:5B38C793A1289D8387DE9298DE497EFEB9F9F4DF
                                                                                                                                                                                      SHA-256:AC343E6ACBEC1B5FE008DB55F73D16D39DCF2FA67C68C6E5A6724C3D5ADD46B9
                                                                                                                                                                                      SHA-512:ECDAB0D673CAE57B66C60AE8A78D5C3227328A4BE3B65573A3201B4FAEFC452A597FB873966A7DC83FAA712F466725DC85DD28103FC3E4423CF77E02412E8700
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K.<....K......K......K......K..q0...K...J...K.......K......K......K.Rich..K.........................PE..L...N..Q.................Z...B......-........p....@.......................................@.....................................x...............................(...@r..................................@............p...............................text....X.......Z.................. ..`.rdata...D...p...F...^..............@..@.data....4..........................@....rsrc...............................@..@.reloc..< ......."...~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\DTCrashReport.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):211816
                                                                                                                                                                                      Entropy (8bit):6.253662936528152
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:3072:E7Ym938HMVQi9UnaLsOX1mh4l94Ly8yyuCLjOvPTBfngmH5lvp+FrNo:E7HGsgnRQ1mh4l94LbyujOvPTBZvpoo
                                                                                                                                                                                      MD5:C24241CA6BA4BF18D56A83CB7476E613
                                                                                                                                                                                      SHA1:7FBC2945CADA19EE560464ABCDB021BB31ACB677
                                                                                                                                                                                      SHA-256:ACB59B58BEF4CD704251B6C54D7D41BA0B45F4BF193DAFCAEA753C72572EBD2A
                                                                                                                                                                                      SHA-512:08FD234338BA1B80FB7899A6B8669B2E7DD84BF6A7FBC24A2583A4F336F86809DB42B4CD5269EED3B9F2B6B8CA1C9F28A405E93D413912661A76AF0B805E81B7
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q...)i..Q...)..7Q...)x..Q.......Q...Q..5Q...)v..Q....h..Q...)m..Q..Rich.Q..................PE..L...o..P..........................................@.......................................@..................................)..x.......8............(..h....p......@...............................h...@............................................text............................... ..`.rdata..............................@..@.data....@...@...$..................@....share...............B..............@....rsrc...8............D..............@..@.reloc...!...p..."..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\NotifyDown.dll

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):95672
                                                                                                                                                                                      Entropy (8bit):6.6937318000741275
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:1536:e3xrgW/1y6ixonvifzkoqyRvCG1oc9fd5xUMAi/mHD7nToIfMIOy460A4IZ21H6h:e3xEZxonvCzkopCeo05xUnImHnTBfCIh
                                                                                                                                                                                      MD5:4A91D40ECCBDBA40C2827685DAC6CCC4
                                                                                                                                                                                      SHA1:9F51DD317472BABEF44E753683D69DB30CF0A1E9
                                                                                                                                                                                      SHA-256:D74A30E47767BEE84C8C20842B1B958ACD32A3DFCD7E7A4920036133F90C81FF
                                                                                                                                                                                      SHA-512:FC0FD9471F6D8939C940F76171A6FF9DE3E6C27112DA6F9A9B465E4F8BFFA4AFD23C9DA701030622A11A417C717411F0B3534AAD209D7AD765C3CD9F7D46CF31
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=Lw>y-.my-.my-.m.1.mx-.m.1.m.-.m.2.m}-.m.2.m}-.m.%Fmx-.m.%Dmd-.my-.my,.mO..mi-.mO..mr-.m.+.mx-.m...mx-.mRichy-.m................PE..L......N...........!............................................................................................... 4.......!......................``..X............................................................................................text............................... ..`.rdata...D.......F..................@..@.data....1...@... ...(..............@....rsrc................H..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\360bizhi\Uninstall.exe

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):268224
                                                                                                                                                                                      Entropy (8bit):7.882911756617939
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:6144:bpRkdfPAvEQ5eHe/WcUrKTdu63g8EBVBdfrOTY621ru:s0Ege+CsIig8edfrOeq
                                                                                                                                                                                      MD5:1334B6FF2C4E06458934213CD7772A62
                                                                                                                                                                                      SHA1:A35BA3AC230B65058BC3A490F5672ABE877C4E63
                                                                                                                                                                                      SHA-256:019B78EC242D0D2A70557B78C6A28D4554C0882840494AA60439D8DEBD708CA6
                                                                                                                                                                                      SHA-512:3B93DE448B3F7231C3B92CA258EAFC4D959FBE5C1A86E9F5DD39E4A07A5DED7593C113C840E637E87CFF538816E32FC5283DB6B0CD23734686D6491F5A634E85
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uJ...$...$...$./.{...$...%.:.$.".y...$..7....$.f."...$.Rich..$.................PE..L.....pG.................Z...(......%2.......p....@..........................P......&/.......................................s...........G..........@................................................................p...............................text...4Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................p..............@....ndata.......@...........................rsrc....G.......H...t..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\360????.lnk

                                                                                                                                                                                      Download File
                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu May 23 07:36:12 2013, mtime=Thu Dec 28 22:37:36 2023, atime=Thu May 23 07:36:12 2013, length=3760960, window=hideshowminimized
                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                      Size (bytes):1316
                                                                                                                                                                                      Entropy (8bit):4.6254030265509165
                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                      SSDEEP:24:8mCMbyEcdOE1ItlVh85TzTbyAiERdBdldBmUUm1bQyBqygm:8mCMblcdOcI45PRiodBdpH1Kyg
                                                                                                                                                                                      MD5:5386BFC2CE1C33BD80831873693A3562
                                                                                                                                                                                      SHA1:D02F961CF334E7094360DEE2C5C2D75FF9D01D48
                                                                                                                                                                                      SHA-256:71A5C86AADE7C22FF30D599462F100B890F3703106FBF1B69D85B9BE84167611
                                                                                                                                                                                      SHA-512:4D978D6F2318DDBB1415F42445FA9B5989F96F90CC6289D25E7BB8FE1FEC3D15E42E0E77F0F13B86310A57245D64262408CD3629A212C360174DCDF1A13038F0
                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                      Preview:L..................F.... ...h..W.......9..h..W..@c9.....................#....P.O. .:i.....+00.../C:\.....................1......W`...PROGRA~2.........O.I.Wp.....................V......T..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....J.1......W`...360.8......W`..W`...........................S..3.6.0.....^.1......W....360DES~1..F......W`..W...............................3.6.0.D.e.s.k.t.o.p.....J.1......W....Bin.8......Wb..W......J.......................%.B.i.n.....j.2.@c9..B.D .360DES~1.EXE..N......B.D.W.......C.....................G..3.6.0.D.e.s.k.t.o.p...e.x.e.......g...............-.......f...........W..9.....C:\Program Files (x86)\360\360Desktop\Bin\360Desktop.exe..J.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.\.3.6.0.D.e.s.k.t.o.p...e.x.e.).C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.3.6.0.\.3.6.0.D.e.s.k.t.o.p.\.B.i.n.........*................@Z|...K.J...

                                                                                                                                                                                      Static File Info

                                                                                                                                                                                      General

                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                      Entropy (8bit):7.992113234589977
                                                                                                                                                                                      TrID:
                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                      File name:SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      File size:22'004'296 bytes
                                                                                                                                                                                      MD5:aae3eedbdc1b1a99f7c2844f85352692
                                                                                                                                                                                      SHA1:8025c689f73816e6c275e38002649d91244d6db2
                                                                                                                                                                                      SHA256:2c1d65f58f07ad391492f0c0b1c335321f7b0d6e9f41218e04404e7b58692ddb
                                                                                                                                                                                      SHA512:85572587d270bd81180ef6f71bd7ea67ef68e043d2938cf44821efa8f448141f821219fc5f9eef5896c92098e0cb1c49c2a094cf52dae5dc9bfdca0b69f67766
                                                                                                                                                                                      SSDEEP:393216:MM29LTLRF5Aqahe8A6+M5JnOHz15dDaYqZJRPcVxkbnpIwpmXhd99lEuts:Mn9LBF5AiDzM5OzndDfwJRPUepfmxbot
                                                                                                                                                                                      TLSH:E9273322BBCAC0BAEBD2233545A99B1F6975F6324B505DCBB3E50B5C4E216C06D36313
                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7I.OV'.OV'.OV'.....KV'.F...SV'.Q...JV'.F....V'.F...\V'.h.J.KV'.h.\.hV'.OV&..W'.F....V'.Q...NV'.F...NV'.RichOV'................

                                                                                                                                                                                      File Icon

                                                                                                                                                                                      Icon Hash:3b317131256b652f

                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                      General

                                                                                                                                                                                      Entrypoint:0x469a9a
                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                      Time Stamp:0x51947733 [Thu May 16 06:05:39 2013 UTC]
                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                      OS Version Major:5
                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                      File Version Major:5
                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                      Subsystem Version Major:5
                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                      Import Hash:404cf80e26b57b92c5197972a37704a5

                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                      Signature Issuer:CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                      • 11/03/2013 01:00:00 11/03/2016 00:59:59
                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                      • CN=Qihoo 360 Software (Beijing) Company Limited, OU=Tech. Dev. Dept., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Qihoo 360 Software (Beijing) Company Limited, L=Beijing, S=Beijing, C=CN
                                                                                                                                                                                      Version:3
                                                                                                                                                                                      Thumbprint MD5:3CA61B8826F65521BFB360E9053FC4F7
                                                                                                                                                                                      Thumbprint SHA-1:1E5BB77FCB63F26277F95AAE09B852699327A08A
                                                                                                                                                                                      Thumbprint SHA-256:BF14AC18F94AB836E88591B971FA00AC7A690A22E1354016059FBC12351558C8
                                                                                                                                                                                      Serial:51BD5D8E45B82A0210F17FE4C5233468

                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                      Instruction
                                                                                                                                                                                      call 00007F7B2CF50B56h
                                                                                                                                                                                      jmp 00007F7B2CF4407Eh
                                                                                                                                                                                      mov edi, edi
                                                                                                                                                                                      push ebp
                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                      cmp dword ptr [ebp+10h], 00000000h
                                                                                                                                                                                      jne 00007F7B2CF44206h
                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                      pop ebp
                                                                                                                                                                                      ret
                                                                                                                                                                                      mov edx, dword ptr [ebp+0Ch]
                                                                                                                                                                                      mov ecx, dword ptr [ebp+08h]
                                                                                                                                                                                      dec dword ptr [ebp+10h]
                                                                                                                                                                                      je 00007F7B2CF44215h
                                                                                                                                                                                      movzx eax, word ptr [ecx]
                                                                                                                                                                                      test ax, ax
                                                                                                                                                                                      je 00007F7B2CF4420Dh
                                                                                                                                                                                      cmp ax, word ptr [edx]
                                                                                                                                                                                      jne 00007F7B2CF44208h
                                                                                                                                                                                      inc ecx
                                                                                                                                                                                      inc ecx
                                                                                                                                                                                      inc edx
                                                                                                                                                                                      inc edx
                                                                                                                                                                                      jmp 00007F7B2CF441EAh
                                                                                                                                                                                      movzx eax, word ptr [ecx]
                                                                                                                                                                                      movzx ecx, word ptr [edx]
                                                                                                                                                                                      sub eax, ecx
                                                                                                                                                                                      pop ebp
                                                                                                                                                                                      ret
                                                                                                                                                                                      mov edi, edi
                                                                                                                                                                                      push ebp
                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                      sub esp, 0Ch
                                                                                                                                                                                      mov eax, dword ptr [004A9118h]
                                                                                                                                                                                      xor eax, ebp
                                                                                                                                                                                      mov dword ptr [ebp-04h], eax
                                                                                                                                                                                      push esi
                                                                                                                                                                                      xor esi, esi
                                                                                                                                                                                      push edi
                                                                                                                                                                                      cmp ebx, esi
                                                                                                                                                                                      jne 00007F7B2CF44220h
                                                                                                                                                                                      call 00007F7B2CF470FAh
                                                                                                                                                                                      push 00000016h
                                                                                                                                                                                      pop edi
                                                                                                                                                                                      push esi
                                                                                                                                                                                      push esi
                                                                                                                                                                                      push esi
                                                                                                                                                                                      push esi
                                                                                                                                                                                      push esi
                                                                                                                                                                                      mov dword ptr [eax], edi
                                                                                                                                                                                      call 00007F7B2CF41434h
                                                                                                                                                                                      add esp, 14h
                                                                                                                                                                                      mov eax, edi
                                                                                                                                                                                      jmp 00007F7B2CF4434Ch
                                                                                                                                                                                      push dword ptr [ebp+08h]
                                                                                                                                                                                      push ebx
                                                                                                                                                                                      call 00007F7B2CF44410h
                                                                                                                                                                                      pop ecx
                                                                                                                                                                                      pop ecx
                                                                                                                                                                                      cmp eax, dword ptr [ebp+08h]
                                                                                                                                                                                      jc 00007F7B2CF44209h
                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                      mov word ptr [ebx], ax
                                                                                                                                                                                      jmp 00007F7B2CF441CDh
                                                                                                                                                                                      mov edx, dword ptr [ebp+0Ch]
                                                                                                                                                                                      mov eax, dword ptr [edx]
                                                                                                                                                                                      mov ecx, dword ptr [eax+14h]
                                                                                                                                                                                      cmp ecx, esi
                                                                                                                                                                                      jne 00007F7B2CF4422Ch
                                                                                                                                                                                      mov eax, ebx
                                                                                                                                                                                      cmp word ptr [ebx], si
                                                                                                                                                                                      je 00007F7B2CF4421Eh
                                                                                                                                                                                      movzx ecx, word ptr [eax]
                                                                                                                                                                                      cmp cx, 0041h
                                                                                                                                                                                      jc 00007F7B2CF4420Eh
                                                                                                                                                                                      cmp cx, 005Ah
                                                                                                                                                                                      jnbe 00007F7B2CF44208h
                                                                                                                                                                                      add ecx, 20h
                                                                                                                                                                                      mov word ptr [eax], cx
                                                                                                                                                                                      inc eax
                                                                                                                                                                                      inc eax
                                                                                                                                                                                      cmp word ptr [eax], si
                                                                                                                                                                                      jne 00007F7B2CF441E6h
                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                      jmp 00007F7B2CF442FFh
                                                                                                                                                                                      push dword ptr [eax+00h]

                                                                                                                                                                                      Rich Headers

                                                                                                                                                                                      Programming Language:
                                                                                                                                                                                      • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                                      • [C++] VS2008 build 21022
                                                                                                                                                                                      • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                      • [ C ] VS2005 build 50727
                                                                                                                                                                                      • [IMP] VS2005 build 50727
                                                                                                                                                                                      • [C++] VS2008 SP1 build 30729
                                                                                                                                                                                      • [RES] VS2008 build 21022
                                                                                                                                                                                      • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                                      Data Directories

                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xa3e900x190.rdata
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xae0000xec0a0.rsrc
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x14fa7980x1ab0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x19b0000x7444.reloc
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x8b6f00x1c.rdata
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x982700x40.rdata
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x8b0000x618.rdata
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                      Sections

                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                      .text0x10000x8912c0x89200False0.5042445305378305data6.57735167781926IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                      .rdata0x8b0000x1b0820x1b200False0.3235527073732719data4.5992220814652605IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                      .data0xa70000x69b80x3e00False0.248046875data4.123195216012852IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                      .rsrc0xae0000xec0a00xec200False0.9657505211090525data7.960227616232132IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                      .reloc0x19b0000xa2b60xa400False0.5201505335365854data5.496479285816793IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                      Resources

                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                      DLL0xaebb00x5ff017-zip archive data, version 0.4ChineseChina1.0002468438343755
                                                                                                                                                                                      DLL0x10eab40x341b3Microsoft Cabinet archive data, Windows 2000/XP setup, 213427 bytes, 1 file, at 0x2c +A "7z.dll", number 1, 12 datablocks, 0x1 compressionChineseChina1.0003373518814396
                                                                                                                                                                                      LICENCE0x142c680x1ad8Unicode text, UTF-16, little-endian text, with CRLF line terminatorsChineseChina0.539871944121071
                                                                                                                                                                                      OEMDATA0x1447400x567-zip archive data, version 0.3ChineseChina0.9069767441860465
                                                                                                                                                                                      SETUPCONFIG0x1447980x2f0a7-zip archive data, version 0.4ChineseChina1.000913469523335
                                                                                                                                                                                      SETUPDATA0x1476a40x18dataChineseChina1.3333333333333333
                                                                                                                                                                                      SETUPPLUGIN0x1476bc0x10dataChineseChina0.6875
                                                                                                                                                                                      SKIN0x1476cc0x254df7-zip archive data, version 0.4ChineseChina1.0003664945451214
                                                                                                                                                                                      RT_ICON0x16cbac0xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsChineseChina0.582089552238806
                                                                                                                                                                                      RT_ICON0x16da540x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsChineseChina0.730595667870036
                                                                                                                                                                                      RT_ICON0x16e2fc0x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsChineseChina0.5541907514450867
                                                                                                                                                                                      RT_ICON0x16e8640xfda7PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedChineseChina0.9992145992145992
                                                                                                                                                                                      RT_ICON0x17e60c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600ChineseChina0.5579875518672199
                                                                                                                                                                                      RT_ICON0x180bb40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224ChineseChina0.5956848030018762
                                                                                                                                                                                      RT_ICON0x181c5c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088ChineseChina0.7384751773049646
                                                                                                                                                                                      RT_ICON0x1820c40x10a77PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedChineseChina0.9740966063182585
                                                                                                                                                                                      RT_ICON0x192b3c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600ChineseChina0.4276970954356846
                                                                                                                                                                                      RT_ICON0x1950e40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224ChineseChina0.4896810506566604
                                                                                                                                                                                      RT_ICON0x19618c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088ChineseChina0.40691489361702127
                                                                                                                                                                                      RT_DIALOG0x1965f40x2cdataChineseChina0.8409090909090909
                                                                                                                                                                                      RT_DIALOG0x1966200x350dataChineseChina0.5176886792452831
                                                                                                                                                                                      RT_DIALOG0x1969700xdcdataChineseChina0.7227272727272728
                                                                                                                                                                                      RT_DIALOG0x196a4c0x1dadataChineseChina0.5780590717299579
                                                                                                                                                                                      RT_DIALOG0x196c280x1acdataChineseChina0.5677570093457944
                                                                                                                                                                                      RT_DIALOG0x196dd40xdedataChineseChina0.7117117117117117
                                                                                                                                                                                      RT_DIALOG0x196eb40x1cedataChineseChina0.5735930735930735
                                                                                                                                                                                      RT_DIALOG0x1970840x412dataChineseChina0.5239923224568138
                                                                                                                                                                                      RT_DIALOG0x1974980x6cdataChineseChina0.75
                                                                                                                                                                                      RT_DIALOG0x1975040x152dataChineseChina0.4940828402366864
                                                                                                                                                                                      RT_STRING0x1976580x2d8dataChineseChina0.49175824175824173
                                                                                                                                                                                      RT_STRING0x1979300x49adataChineseChina0.6239388794567062
                                                                                                                                                                                      RT_STRING0x197dcc0x5a4dataChineseChina0.5706371191135734
                                                                                                                                                                                      RT_STRING0x1983700x1aadataChineseChina0.755868544600939
                                                                                                                                                                                      RT_STRING0x19851c0x1d4dataChineseChina0.7243589743589743
                                                                                                                                                                                      RT_STRING0x1986f00x49cdataChineseChina0.4872881355932203
                                                                                                                                                                                      RT_STRING0x198b8c0x294dataChineseChina0.7090909090909091
                                                                                                                                                                                      RT_STRING0x198e200x19adataChineseChina0.8512195121951219
                                                                                                                                                                                      RT_STRING0x198fbc0x17edataChineseChina0.6387434554973822
                                                                                                                                                                                      RT_STRING0x19913c0x86dataChineseChina0.7985074626865671
                                                                                                                                                                                      RT_STRING0x1991c40xf4dataChineseChina0.6844262295081968
                                                                                                                                                                                      RT_STRING0x1992b80x68AmigaOS bitmap font "egSb \220\250`\352\201\361]\204v3", 60255 elementsChineseChina0.8076923076923077
                                                                                                                                                                                      RT_STRING0x1993200x24dataChineseChina0.4444444444444444
                                                                                                                                                                                      RT_STRING0x1993440x56dataChineseChina0.6627906976744186
                                                                                                                                                                                      RT_STRING0x19939c0x2cdataChineseChina0.5454545454545454
                                                                                                                                                                                      RT_STRING0x1993c80x128dataChineseChina0.597972972972973
                                                                                                                                                                                      RT_STRING0x1994f00x22dataChineseChina0.38235294117647056
                                                                                                                                                                                      RT_ACCELERATOR0x1995140x70dataChineseChina0.6785714285714286
                                                                                                                                                                                      RT_RCDATA0x1995840x80OpenPGP Public KeyEnglishUnited States1.0859375
                                                                                                                                                                                      RT_GROUP_ICON0x1996040x68dataChineseChina0.6923076923076923
                                                                                                                                                                                      RT_GROUP_ICON0x19966c0x3eTarga image data - Map 32 x 2679 x 1 +1ChineseChina0.8548387096774194
                                                                                                                                                                                      RT_VERSION0x1996ac0x5acdataChineseChina0.3409090909090909
                                                                                                                                                                                      RT_MANIFEST0x199c580x448ASCII text, with very long lines (612), with CRLF line terminatorsEnglishUnited States0.47354014598540145

                                                                                                                                                                                      Imports

                                                                                                                                                                                      DLLImport
                                                                                                                                                                                      KERNEL32.dllFindFirstFileW, FormatMessageW, CopyFileW, GetVolumeInformationW, OpenProcess, CompareFileTime, SetThreadPriority, GetCurrentThread, SetPriorityClass, GetEnvironmentVariableW, GetSystemInfo, InitializeCriticalSection, DeleteCriticalSection, GetLongPathNameW, lstrcmpiW, CreateMutexW, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetCommandLineW, QueryDosDeviceW, GetLogicalDriveStringsW, GetSystemDirectoryW, CreateProcessW, FindAtomW, GlobalAddAtomW, GetTickCount, QueryPerformanceCounter, QueryPerformanceFrequency, CreateFileA, GetTempPathA, GlobalUnlock, GlobalLock, GlobalAlloc, GetPrivateProfileStringW, CreateThread, TerminateProcess, FindResourceExW, GetDiskFreeSpaceExW, LockResource, GetFileTime, ReadProcessMemory, GetFileSizeEx, GetFullPathNameW, GetPrivateProfileIntW, FindClose, FindNextFileW, lstrcpyW, CreateToolhelp32Snapshot, LocalAlloc, LocalFree, GetTempFileNameW, GetFileAttributesW, LoadLibraryW, GetCurrentProcessId, CreateFileW, DeviceIoControl, GlobalFindAtomW, GetVersionExW, CreateDirectoryW, lstrcmpiA, Process32FirstW, WriteConsoleW, GetConsoleOutputCP, WritePrivateProfileStringW, GetDriveTypeA, GetCurrentDirectoryA, FlushFileBuffers, SetStdHandle, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetStringTypeW, GetStringTypeA, GetLocaleInfoA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetConsoleMode, GetConsoleCP, GetModuleHandleA, GetStartupInfoA, SetHandleCount, IsValidCodePage, GetOEMCP, GetModuleFileNameA, HeapCreate, GetCPInfo, LCMapStringW, LCMapStringA, GetStartupInfoW, ExitProcess, ExitThread, RtlUnwind, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, SystemTimeToFileTime, LocalFileTimeToFileTime, InitializeCriticalSectionAndSpinCount, GetACP, SetEnvironmentVariableW, TlsFree, TlsAlloc, Process32NextW, WriteFile, GetDriveTypeW, SetLastError, GetCurrentThreadId, GetCurrentProcess, FlushInstructionCache, LeaveCriticalSection, lstrcatW, Sleep, GetLocalTime, GetModuleFileNameW, GetShortPathNameW, MoveFileW, MoveFileExW, DeleteFileW, GetProcAddress, FreeLibrary, SetFileAttributesW, RemoveDirectoryW, GetTempPathW, lstrlenA, OutputDebugStringW, DebugBreak, InterlockedIncrement, lstrlenW, InterlockedDecrement, WaitForSingleObject, CloseHandle, EnterCriticalSection, MulDiv, RaiseException, GetModuleHandleW, CreateEventW, SetEvent, GetLocaleInfoW, GetLastError, ResetEvent, LockFile, GetFileSize, OpenThread, TlsSetValue, TlsGetValue, ReleaseMutex, SetFilePointerEx, GetFileType, lstrcmpA, GetSystemTime, ReadFile, UnlockFile, CreateFileMappingW, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, HeapDestroy, VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, LoadLibraryA, HeapAlloc, GetProcessHeap, HeapFree, InterlockedCompareExchange, GetStdHandle, SetEndOfFile, SetFileTime, GetFileAttributesExW, UnmapViewOfFile, SetFilePointer, WriteConsoleA, WideCharToMultiByte, MapViewOfFile, GetExitCodeProcess
                                                                                                                                                                                      USER32.dllIsWindow, SendMessageW, CharNextW, CharUpperW, LoadStringW, PostMessageW, FindWindowW, SendMessageTimeoutW, wvsprintfW, EnableWindow, GetDlgItem, IsWindowEnabled, ShowWindow, SetDlgItemTextW, IsWindowVisible, EndDialog, GetWindowLongW, SetWindowTextW, EnumWindows, GetClassNameW, GetWindowThreadProcessId, EmptyClipboard, SetClipboardData, CloseClipboard, SetCursor, PtInRect, OpenClipboard, MessageBoxW, wsprintfW, WaitForInputIdle, DialogBoxParamW, OffsetRect, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, BringWindowToTop, RegisterClassExW, LoadCursorW, GetClassInfoExW, GetSystemMetrics, LoadImageW, IsIconic, PostQuitMessage, InflateRect, IsDialogMessageW, GetSystemMenu, EnableMenuItem, GetActiveWindow, CharLowerW, EndPaint, BeginPaint, CallWindowProcW, DefWindowProcW, CopyRect, KillTimer, SetTimer, CreateDialogParamW, GetWindowTextLengthW, MessageBeep, SetFocus, RedrawWindow, InvalidateRect, DestroyWindow, CreateWindowExW, FindWindowExW, GetWindowTextW, ReleaseDC, GetDC, SetWindowLongW, GetParent, GetWindow, GetWindowRect, ExitWindowsEx, UnregisterClassA, MonitorFromWindow, GetMonitorInfoW, MapWindowPoints, SetWindowPos, ScreenToClient, GetClientRect, MoveWindow
                                                                                                                                                                                      GDI32.dllCreateCompatibleDC, DeleteDC, CreateCompatibleBitmap, DeleteObject, BitBlt, SetViewportOrgEx, SelectObject
                                                                                                                                                                                      ADVAPI32.dllLookupAccountSidW, RegQueryInfoKeyW, RegDeleteValueW, RegDeleteKeyW, RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, GetUserNameW, GetNamedSecurityInfoW, BuildExplicitAccessWithNameW, SetEntriesInAclW, SetNamedSecurityInfoW, GetExplicitEntriesFromAclW, EqualSid, GetTrusteeNameW, DeleteAce, RegOpenKeyExA, LookupAccountNameW, RegOpenKeyW, RegEnumKeyExW, RegCloseKey, RegEnumKeyExA, RegQueryValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegQueryValueExA
                                                                                                                                                                                      SHELL32.dllShellExecuteW, ShellExecuteExW, SHCreateDirectoryExW, SHChangeNotify, SHGetSpecialFolderPathW, SHGetSpecialFolderLocation, SHGetMalloc, SHGetFolderPathW, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW
                                                                                                                                                                                      ole32.dllOleRun, CoInitialize, CoUninitialize, CoCreateGuid, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance, CoTaskMemRealloc
                                                                                                                                                                                      OLEAUT32.dllVariantClear, SysAllocStringByteLen, SysStringByteLen, VarUI4FromStr, VariantInit, SysStringLen, SysFreeString, SysAllocString
                                                                                                                                                                                      SHLWAPI.dllSHGetValueA, PathFileExistsW, SHGetValueW, PathCombineW, PathFindFileNameW, SHDeleteValueW, SHDeleteKeyW, PathIsRelativeW, PathAppendW, PathAddBackslashW, PathRemoveFileSpecW, PathIsPrefixW, wnsprintfW, PathRemoveBackslashW, PathAppendA, SHSetValueA, PathFindExtensionW, StrCmpIW, PathIsDirectoryW, PathIsURLW, PathIsNetworkPathW, StrRetToStrW, PathMatchSpecW, PathRemoveExtensionW, SHSetValueW
                                                                                                                                                                                      COMCTL32.dllInitCommonControlsEx
                                                                                                                                                                                      MSIMG32.dllAlphaBlend
                                                                                                                                                                                      VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                                                                                                                                                                      PSAPI.DLLGetProcessImageFileNameW, EnumProcesses, GetModuleFileNameExW
                                                                                                                                                                                      urlmon.dllURLDownloadToFileW, URLDownloadToCacheFileW
                                                                                                                                                                                      IPHLPAPI.DLLGetAdaptersInfo
                                                                                                                                                                                      WININET.dllInternetGetConnectedState
                                                                                                                                                                                      NETAPI32.dllNetbios
                                                                                                                                                                                      SETUPAPI.dllSetupIterateCabinetW
                                                                                                                                                                                      CRYPT32.dllCryptMsgClose, CertCloseStore, CryptMsgUpdate, CryptMsgOpenToDecode, CertOpenStore, CertGetNameStringW, CertGetCertificateContextProperty
                                                                                                                                                                                      WINTRUST.dllWTHelperGetProvSignerFromChain, WTHelperProvDataFromStateData

                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                      ChineseChina
                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                      Dec 29, 2023 00:34:52.572990894 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:34:52.908353090 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:34:52.908524990 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:34:52.909001112 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:34:53.244669914 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:34:53.244698048 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:34:53.244771957 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:34:59.390960932 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:34:59.738418102 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:34:59.740510941 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:07.913032055 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:08.248414040 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:08.248486996 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:14.374689102 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:14.710832119 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:14.710911036 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:20.866072893 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:21.201472044 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:21.201545000 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:27.532919884 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:27.868343115 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:27.868419886 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:32.793870926 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:33.129270077 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:33.129340887 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:35.272314072 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:35.597090960 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:35.600307941 CET4971880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:35.609736919 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:35.610472918 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:35.916423082 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:35.916520119 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:35.919447899 CET8049718101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:35.919513941 CET4971880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:35.920334101 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:35.930074930 CET4971880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:36.241249084 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:36.241269112 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:36.241344929 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:36.250334978 CET8049718101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:36.263149977 CET8049718101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:36.263184071 CET8049718101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:36.263245106 CET4971880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:36.289413929 CET4971880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:36.608421087 CET8049718101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:36.731853008 CET4972180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:37.033325911 CET8049721101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:37.034739017 CET4972180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:37.039297104 CET4972180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:37.343875885 CET8049721101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:37.356605053 CET8049721101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:37.356626987 CET8049721101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:37.356703043 CET4972180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:37.383193970 CET4972180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:35:37.684731007 CET8049721101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:45.607939959 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:45.608218908 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.099939108 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.241259098 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.241617918 CET4970880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.241902113 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.241902113 CET4971780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.242283106 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.419346094 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.556221008 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.556323051 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.561109066 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.561124086 CET8049717171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.576767921 CET8049708171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.600261927 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:46.914390087 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.914726019 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.915225029 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:54.571779966 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:35:54.886162996 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:54.886351109 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:03.198215961 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:03.512296915 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:03.512396097 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:09.766801119 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:10.083152056 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:10.083383083 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:16.991801977 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.306067944 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:17.306142092 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.622956038 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.624284029 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.936820984 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:17.936928034 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.937134027 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:17.937427044 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.964256048 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:17.965435982 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.274972916 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.274997950 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.275130033 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.279565096 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.279622078 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.328845024 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.328989029 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.378374100 CET4975480192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:18.639628887 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.639933109 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.641706944 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.643044949 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.643122911 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.680634022 CET8049754101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.680728912 CET4975480192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:18.690186977 CET4975480192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:18.952501059 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.952615976 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:18.992321968 CET8049754101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.992338896 CET8049754101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.992413044 CET8049754101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.992459059 CET4975480192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:19.018174887 CET4975480192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:19.081029892 CET4975580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:19.320332050 CET8049754101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:19.402524948 CET8049755101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:19.402631998 CET4975580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:19.408819914 CET4975580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:19.728214025 CET8049755101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:19.728250980 CET8049755101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:19.728264093 CET8049755101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:19.728333950 CET4975580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:19.752595901 CET4975580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:20.072035074 CET8049755101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:23.677452087 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:23.988179922 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:23.988269091 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:28.643204927 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:28.643296003 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:30.690320969 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:31.002459049 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:31.002537966 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.131787062 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.149496078 CET4972580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.150372982 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.442481041 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.442554951 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.458472013 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.463850975 CET8049725171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.465811968 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.466378927 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.505110979 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.668735027 CET4977080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:38.769887924 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.770628929 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.772625923 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.820617914 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.820633888 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.820703983 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.821916103 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:38.972609043 CET8049770101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:38.972743034 CET4977080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:38.980153084 CET4977080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:39.083666086 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.083767891 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:39.093909979 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:39.137329102 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.137402058 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:39.139195919 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:39.284044027 CET8049770101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.284059048 CET8049770101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.284073114 CET8049770101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.284137011 CET4977080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:39.308280945 CET4977080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:39.371031046 CET4977180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:39.404639006 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.404753923 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:39.454684019 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.454765081 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:39.614340067 CET8049770101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.692049026 CET8049771101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.692162991 CET4977180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:39.698844910 CET4977180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:40.019727945 CET8049771101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:40.019849062 CET8049771101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:40.019862890 CET8049771101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:40.019923925 CET4977180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:40.042727947 CET4977180192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:40.363676071 CET8049771101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:45.538108110 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:45.853878975 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:45.853960037 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:49.404659986 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:49.404706955 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:52.077105045 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:52.392759085 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:52.392854929 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.442926884 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.444005966 CET4975380192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.444967031 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.754771948 CET8049753171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:57.758431911 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:57.758518934 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.769186020 CET8049784171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:57.769310951 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.776842117 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:57.777416945 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.069525003 CET4978580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:58.092227936 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.092298031 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.098139048 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.101541042 CET8049784171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.101587057 CET8049784171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.105163097 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.105714083 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.372694016 CET8049785101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.372786045 CET4978580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:58.391282082 CET4978580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:58.413696051 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.413770914 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.417661905 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.430932999 CET8049784171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.431010962 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.694555998 CET8049785101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.694575071 CET8049785101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.694591045 CET8049785101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.694645882 CET4978580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:58.716479063 CET4978580192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:58.733025074 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.733131886 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:58.794642925 CET4978680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:58.810522079 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:36:59.020546913 CET8049785101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:59.096848965 CET8049786101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:59.101185083 CET4978680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:36:59.126010895 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:59.126064062 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:06.967778921 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:07.283323050 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:07.283399105 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:08.429702044 CET8049784171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:08.429766893 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.569399118 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.569921017 CET4978480192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.571368933 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.884973049 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:09.885032892 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.891727924 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:09.891807079 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.892112017 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:09.893995047 CET8049784171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:09.923795938 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.212454081 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.212546110 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.212644100 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.216862917 CET4978880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:10.222560883 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.239078999 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.239135027 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.239940882 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.538084984 CET8049788101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.538194895 CET4978880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:10.542962074 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.543049097 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.544148922 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.544284105 CET4978880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:10.555207014 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.555279970 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.864629984 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.864702940 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:10.865309954 CET8049788101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.865390062 CET8049788101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.865405083 CET8049788101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.865459919 CET4978880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:10.887991905 CET4978880192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:11.029337883 CET4978980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:11.209098101 CET8049788101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:11.331443071 CET8049789101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:11.331538916 CET4978980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:11.341151953 CET4978980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:11.643342972 CET8049789101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:11.643367052 CET8049789101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:11.643379927 CET8049789101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:11.643440008 CET4978980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:11.669254065 CET4978980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:11.971443892 CET8049789101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:13.786082029 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:14.106503963 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:14.106611967 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:20.555844069 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:20.555974007 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.107292891 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.107383966 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.186460018 CET4978780192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.186825037 CET4976980192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.188235044 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.500035048 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.500154972 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.500675917 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:24.502366066 CET8049769171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.506759882 CET8049787171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.812433004 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.812469959 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.812530041 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.286772013 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.287775040 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.599111080 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:27.599178076 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.604974985 CET8049805171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:27.605041027 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.609848976 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.611183882 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.793121099 CET4980680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:27.923193932 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:27.923449993 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.926059008 CET8049805171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:27.926127911 CET8049805171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:27.926268101 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.926593065 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:27.929008007 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:28.095690966 CET8049806101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.095823050 CET4980680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:28.103336096 CET4980680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:28.239698887 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.239762068 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:28.240330935 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:28.246242046 CET8049805171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.246309996 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:28.406778097 CET8049806101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.443032026 CET8049806101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.443061113 CET8049806101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.443123102 CET4980680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:28.462861061 CET4980680192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:28.525439024 CET4980780192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:28.552372932 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.552447081 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:28.764883995 CET8049806101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.847105026 CET8049807101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.847191095 CET4980780192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:28.853404045 CET4980780192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:29.174663067 CET8049807101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:29.175544977 CET8049807101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:29.175559998 CET8049807101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:29.175623894 CET4980780192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:29.197117090 CET4980780192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:29.518322945 CET8049807101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:31.216882944 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:31.529124022 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:31.529189110 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:37.990012884 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:38.245583057 CET8049805171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:38.245750904 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:38.302226067 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:38.302390099 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.052628040 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.053817987 CET4980580192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.054869890 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.364913940 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:43.364979982 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.370064974 CET8049805171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:43.376907110 CET8049808171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:43.376993895 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.411056995 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.414524078 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.710016966 CET4980980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:43.723146915 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:43.723244905 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.731295109 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.736565113 CET8049808171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:43.736601114 CET8049808171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:43.736668110 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:43.748078108 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:44.030452013 CET8049809101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.030590057 CET4980980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:44.043236017 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.043524981 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:44.048813105 CET4980980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:44.056545973 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:44.070405006 CET8049808171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.070987940 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:44.368494987 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.368736982 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:44.369112015 CET8049809101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.369198084 CET8049809101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.369211912 CET8049809101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.369541883 CET4980980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:44.400194883 CET4980980192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:44.463011026 CET4981080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:44.720583916 CET8049809101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.765063047 CET8049810101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.765141010 CET4981080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:44.775177002 CET4981080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:45.077373981 CET8049810101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:45.077395916 CET8049810101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:45.077409983 CET8049810101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:45.077455997 CET4981080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:45.103276014 CET4981080192.168.2.5101.198.2.147
                                                                                                                                                                                      Dec 29, 2023 00:37:45.406146049 CET8049810101.198.2.147192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:47.651221037 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:47.963289976 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:47.963699102 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:54.074055910 CET8049808171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:54.074115992 CET4980880192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:55.510549068 CET4980280192.168.2.5171.8.167.89
                                                                                                                                                                                      Dec 29, 2023 00:37:55.822606087 CET8049802171.8.167.89192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:55.822660923 CET4980280192.168.2.5171.8.167.89

                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                      Dec 29, 2023 00:34:52.424222946 CET5550153192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:34:52.546715975 CET53555011.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:34:59.393486977 CET6127553192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:34:59.690332890 CET53612751.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:07.910032034 CET6190253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:08.108989000 CET53619021.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:14.376072884 CET5472253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:14.574985981 CET53547221.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:20.866801977 CET6421253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:21.028163910 CET53642121.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:27.533402920 CET5889853192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:27.694840908 CET53588981.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:32.006818056 CET4971853192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:32.293349981 CET53497181.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:35.271931887 CET5569053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:35.394740105 CET53556901.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:35.457041025 CET5682053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:35.581958055 CET53568201.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:39.595143080 CET6146753192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:40.116090059 CET53614671.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:46.100716114 CET6546253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:46.260241985 CET53654621.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:54.598541021 CET6387453192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:35:54.938333035 CET53638741.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:35:55.880462885 CET6145153192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:03.196747065 CET5865753192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:03.358181000 CET53586571.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:09.764420033 CET5114153192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:10.109539986 CET53511411.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:16.522806883 CET5970853192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:16.557292938 CET5749053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:16.872802019 CET53597081.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:16.891089916 CET53574901.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:18.824274063 CET4997253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:19.174588919 CET53499721.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:23.677791119 CET6264853192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:24.048126936 CET53626481.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:30.692054987 CET5127253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:30.853666067 CET53512721.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:37.294974089 CET5968053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:37.329951048 CET5381053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:37.417396069 CET53596801.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:37.528902054 CET53538101.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:39.216873884 CET5768053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:39.585937023 CET53576801.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:45.539473057 CET5263853192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:45.661875963 CET53526381.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:52.078049898 CET6247453192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:52.365875006 CET53624741.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:57.018208981 CET5935153192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:57.140573978 CET53593511.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.000639915 CET6196953192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:58.122908115 CET53619691.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:36:58.535912991 CET6016553192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:36:58.889364958 CET53601651.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:06.969841957 CET6152153192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:07.091922998 CET53615211.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:09.163017035 CET5358053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:09.481801033 CET53535801.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:10.546330929 CET5872753192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:11.051595926 CET53587271.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:13.790438890 CET5800953192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:14.097212076 CET53580091.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:24.187844992 CET5598853192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:24.309628963 CET53559881.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:26.898228884 CET5291353192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:27.058644056 CET53529131.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:28.250849962 CET5593053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:28.595143080 CET53559301.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:31.216830015 CET5721953192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:31.338923931 CET53572191.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:37.990406990 CET5493053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:38.112497091 CET53549301.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:42.173470020 CET4926253192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:42.202017069 CET6303053192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:42.295922995 CET53492621.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:42.556293964 CET53630301.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.150000095 CET6277453192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:44.549844027 CET6277453192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:44.652440071 CET53627741.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:44.672530890 CET53627741.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:47.651221991 CET6308153192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:47.773412943 CET53630811.1.1.1192.168.2.5
                                                                                                                                                                                      Dec 29, 2023 00:37:55.511190891 CET5879453192.168.2.51.1.1.1
                                                                                                                                                                                      Dec 29, 2023 00:37:55.634242058 CET53587941.1.1.1192.168.2.5

                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                      Dec 29, 2023 00:34:52.424222946 CET192.168.2.51.1.1.10x4010Standard query (0)s.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:34:59.393486977 CET192.168.2.51.1.1.10xa599Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:07.910032034 CET192.168.2.51.1.1.10x82baStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:14.376072884 CET192.168.2.51.1.1.10x14adStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:20.866801977 CET192.168.2.51.1.1.10x3c8dStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:27.533402920 CET192.168.2.51.1.1.10x51a7Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:32.006818056 CET192.168.2.51.1.1.10xbc27Standard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.271931887 CET192.168.2.51.1.1.10xb46eStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.457041025 CET192.168.2.51.1.1.10x45beStandard query (0)s.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:39.595143080 CET192.168.2.51.1.1.10x3c50Standard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:46.100716114 CET192.168.2.51.1.1.10x842fStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:54.598541021 CET192.168.2.51.1.1.10x8b5bStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:55.880462885 CET192.168.2.51.1.1.10x66b2Standard query (0)api.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:03.196747065 CET192.168.2.51.1.1.10x4a63Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:09.764420033 CET192.168.2.51.1.1.10x856bStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:16.522806883 CET192.168.2.51.1.1.10x89aStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:16.557292938 CET192.168.2.51.1.1.10xac70Standard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:18.824274063 CET192.168.2.51.1.1.10xb3Standard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:23.677791119 CET192.168.2.51.1.1.10xbde9Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:30.692054987 CET192.168.2.51.1.1.10xd9cStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:37.294974089 CET192.168.2.51.1.1.10xfcfaStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:37.329951048 CET192.168.2.51.1.1.10xc85aStandard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:39.216873884 CET192.168.2.51.1.1.10x5bc0Standard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:45.539473057 CET192.168.2.51.1.1.10x920cStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:52.078049898 CET192.168.2.51.1.1.10xbefaStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:57.018208981 CET192.168.2.51.1.1.10x47e1Standard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:58.000639915 CET192.168.2.51.1.1.10xc243Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:58.535912991 CET192.168.2.51.1.1.10x506dStandard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:06.969841957 CET192.168.2.51.1.1.10x1591Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:09.163017035 CET192.168.2.51.1.1.10x56efStandard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:10.546330929 CET192.168.2.51.1.1.10x8662Standard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:13.790438890 CET192.168.2.51.1.1.10x4f8Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:24.187844992 CET192.168.2.51.1.1.10x40a9Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:26.898228884 CET192.168.2.51.1.1.10xafedStandard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:28.250849962 CET192.168.2.51.1.1.10xa991Standard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:31.216830015 CET192.168.2.51.1.1.10x4219Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:37.990406990 CET192.168.2.51.1.1.10xd745Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:42.173470020 CET192.168.2.51.1.1.10x97c8Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:42.202017069 CET192.168.2.51.1.1.10xe069Standard query (0)relate.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:44.150000095 CET192.168.2.51.1.1.10xa56eStandard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:44.549844027 CET192.168.2.51.1.1.10xa56eStandard query (0)stat.apc.360safe.comA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:47.651221991 CET192.168.2.51.1.1.10x6f40Standard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:55.511190891 CET192.168.2.51.1.1.10xe39eStandard query (0)stat.apc.360.cnA (IP address)IN (0x0001)false

                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                      Dec 29, 2023 00:34:52.546715975 CET1.1.1.1192.168.2.50x4010No error (0)s.360.cn171.8.167.89A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:34:52.546715975 CET1.1.1.1192.168.2.50x4010No error (0)s.360.cn171.8.167.90A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:34:52.546715975 CET1.1.1.1192.168.2.50x4010No error (0)s.360.cn171.13.14.66A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:34:52.546715975 CET1.1.1.1192.168.2.50x4010No error (0)s.360.cn180.163.251.230A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:34:59.690332890 CET1.1.1.1192.168.2.50xa599Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:08.108989000 CET1.1.1.1192.168.2.50x82baName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:14.574985981 CET1.1.1.1192.168.2.50x14adName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:21.028163910 CET1.1.1.1192.168.2.50x3c8dName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:27.694840908 CET1.1.1.1192.168.2.50x51a7Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:32.293349981 CET1.1.1.1192.168.2.50xbc27Name error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.394740105 CET1.1.1.1192.168.2.50xb46eName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.581958055 CET1.1.1.1192.168.2.50x45beNo error (0)s.360.cn101.198.2.147A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.581958055 CET1.1.1.1192.168.2.50x45beNo error (0)s.360.cn171.8.167.90A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.581958055 CET1.1.1.1192.168.2.50x45beNo error (0)s.360.cn180.163.251.231A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:35.581958055 CET1.1.1.1192.168.2.50x45beNo error (0)s.360.cn180.163.251.230A (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:40.116090059 CET1.1.1.1192.168.2.50x3c50Name error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:46.260241985 CET1.1.1.1192.168.2.50x842fName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:54.938333035 CET1.1.1.1192.168.2.50x8b5bName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:35:56.002288103 CET1.1.1.1192.168.2.50x66b2No error (0)api.msn.comapi-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:03.358181000 CET1.1.1.1192.168.2.50x4a63Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:10.109539986 CET1.1.1.1192.168.2.50x856bName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:16.872802019 CET1.1.1.1192.168.2.50x89aName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:16.891089916 CET1.1.1.1192.168.2.50xac70Name error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:19.174588919 CET1.1.1.1192.168.2.50xb3Name error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:24.048126936 CET1.1.1.1192.168.2.50xbde9Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:30.853666067 CET1.1.1.1192.168.2.50xd9cName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:37.417396069 CET1.1.1.1192.168.2.50xfcfaName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:37.528902054 CET1.1.1.1192.168.2.50xc85aName error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:39.585937023 CET1.1.1.1192.168.2.50x5bc0Name error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:45.661875963 CET1.1.1.1192.168.2.50x920cName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:52.365875006 CET1.1.1.1192.168.2.50xbefaName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:57.140573978 CET1.1.1.1192.168.2.50x47e1Name error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:58.122908115 CET1.1.1.1192.168.2.50xc243Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:36:58.889364958 CET1.1.1.1192.168.2.50x506dName error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:07.091922998 CET1.1.1.1192.168.2.50x1591Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:09.481801033 CET1.1.1.1192.168.2.50x56efName error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:11.051595926 CET1.1.1.1192.168.2.50x8662Name error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:14.097212076 CET1.1.1.1192.168.2.50x4f8Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:24.309628963 CET1.1.1.1192.168.2.50x40a9Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:27.058644056 CET1.1.1.1192.168.2.50xafedName error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:28.595143080 CET1.1.1.1192.168.2.50xa991Name error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:31.338923931 CET1.1.1.1192.168.2.50x4219Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:38.112497091 CET1.1.1.1192.168.2.50xd745Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:42.295922995 CET1.1.1.1192.168.2.50x97c8Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:42.556293964 CET1.1.1.1192.168.2.50xe069Name error (3)relate.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:44.652440071 CET1.1.1.1192.168.2.50xa56eName error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:44.672530890 CET1.1.1.1192.168.2.50xa56eName error (3)stat.apc.360safe.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:47.773412943 CET1.1.1.1192.168.2.50x6f40Name error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                      Dec 29, 2023 00:37:55.634242058 CET1.1.1.1192.168.2.50xe39eName error (3)stat.apc.360.cnnonenoneA (IP address)IN (0x0001)false

                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                      • s.360.cn

                                                                                                                                                                                      HTTP Packets

                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      0192.168.2.549708171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:34:52.909001112 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=1&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=6648 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:34:53.244698048 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:34:53 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:34:59.390960932 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29968 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:34:59.738418102 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:34:59 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:07.913032055 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24957 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:08.248414040 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:08 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:14.374689102 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=13209 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:14.710832119 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:14 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:20.866072893 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1772 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:21.201472044 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:21 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:27.532919884 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23407 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:27.868343115 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:27 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:32.793870926 CET389OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7933&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:33.129270077 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:32 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:35.272314072 CET381OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=37062&r2=15793 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:35.609736919 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:35 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:31 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cf-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      1192.168.2.549717171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:35:35.920334101 CET377OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=17067 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:36.241269112 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:36 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:09 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a405-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:46.099939108 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=18640 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      2192.168.2.549718101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:35:35.930074930 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:35:36.263149977 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:36 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:55 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d27b-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      3192.168.2.549721101.198.2.147805884C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:35:37.039297104 CET180OUTGET /bizhi/s.html?action=wpinst&from=1&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:35:37.356605053 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:37 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:52 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d278-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      4192.168.2.549725171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:35:46.600261927 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=18640 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:46.914726019 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:46 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:35:54.571779966 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=13322 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:35:54.886162996 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:35:54 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:03.198215961 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=8772 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:03.512296915 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:03 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:09.766801119 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=30407 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:10.083152056 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:09 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:16.991801977 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=20906 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:17.306067944 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:17 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:17.622956038 CET952OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:17.937134027 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:17 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:17.965435982 CET940OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:18.279565096 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:18 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:18.328989029 CET382OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=105189&r2=24629 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:18.643044949 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:18 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:32 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4d0-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      5192.168.2.549753171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:17.964256048 CET864OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23303&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:18.274997950 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:18 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:18.328845024 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23355&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:18.639628887 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:18 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:18.641706944 CET377OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=25445 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:18.952501059 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:18 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:23.677452087 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=10282 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:23.988179922 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:23 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:30.690320969 CET374OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=474 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:31.002459049 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:30 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:38.131787062 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24763 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:38.442481041 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:38 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:38.458472013 CET864OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:38.769887924 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:38 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:38.772625923 CET940OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:39.083666086 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:38 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:39.093909979 CET382OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=152251&r2=26191 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:39.404639006 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:39 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      6192.168.2.549754101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:18.690186977 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:36:18.992338896 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:18 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 07:45:56 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295c7b4-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      7192.168.2.549755101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:19.408819914 CET180OUTGET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:36:19.728250980 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:19 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:33 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d265-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      8192.168.2.549769171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:38.505110979 CET952OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24812&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:38.820633888 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:38 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:38.821916103 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24865&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:39.137329102 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:38 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:39.139195919 CET377OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=26498 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:39.454684019 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:39 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:45.538108110 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=16128 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:45.853878975 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:45 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:52.077105045 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=4740 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:52.392759085 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:52 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:57.442926884 CET952OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:57.758431911 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:57 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:57.776842117 CET864OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:58.092227936 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:57 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:58.098139048 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22292&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:58.413696051 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:58 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:58.417661905 CET377OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=24539 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:58.733025074 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:58 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:58.810522079 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=26734 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:59.126010895 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:58 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:06.967778921 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=20600 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:07.283323050 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:07 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:09.569399118 CET952OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:09.884973049 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:09 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:09.923795938 CET940OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:10.239078999 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:10 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:10.239940882 CET382OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=203246&r2=29887 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:10.555207014 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:10 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      9192.168.2.549770101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:38.980153084 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:36:39.284059048 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:39 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:21 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d259-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      10192.168.2.549771101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:39.698844910 CET180OUTGET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:36:40.019849062 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:39 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:21 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d259-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      11192.168.2.549784171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:57.777416945 CET940OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22243&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:58.101587057 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:57 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:36:58.105714083 CET382OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=179645&r2=23925 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:36:58.430932999 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:58 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:50 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b94e-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      12192.168.2.549785101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:36:58.391282082 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:36:58.694575071 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:36:58 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:55 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d27b-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      13192.168.2.549787171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:09.892112017 CET864OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29120&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:10.212546110 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:10 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:08 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a404-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:10.222560883 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=29172&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:10.542962074 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:10 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:08 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a404-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:10.544148922 CET377OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=30243 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:10.864629984 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:10 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:08 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a404-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:13.786082029 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=10129 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:14.106503963 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:13 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:08 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a404-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      14192.168.2.549788101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:10.544284105 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:37:10.865390062 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:10 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:52 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d278-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      15192.168.2.549789101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:11.341151953 CET180OUTGET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:37:11.643367052 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:11 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:45 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d271-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      16192.168.2.549802171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:24.500675917 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=11343 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:24.812469959 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:24 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:27.286772013 CET952OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:27.599111080 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:27 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:27.611183882 CET864OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:27.923193932 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:27 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:27.926593065 CET390OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21499&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:28.239698887 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:28 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:28.240330935 CET377OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22619 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:28.552372932 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:28 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:31.216882944 CET375OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=1538 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:31.529124022 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:31 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:37.990012884 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=23630 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:38.302226067 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:38 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:43.052628040 CET951OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=defaultskin.zip_3|SwitchBarCloud.xml_3|360seNotify.RS_2|360AppCenter.EXE_2|360AppCore.EXE_2|360Desktop.EXE_2|360DesktopSwitch.EXE_2|360DesktopSwitch64.EXE_2|360DTNotify.EXE_2|360dtpreview.EXE_2|360FeedBack.EXE_2|360GameBox.EXE_2|360GbApp.EXE_2|360Inst.EXE_2|360mwapp.EXE_2|360seNotify.EXE_2|360TopBar.EXE_2|360TopbarASS.EXE_2|360wapp.EXE_2|360weibo.EXE_2|360wpappInstaller_zhuomian.EXE_2|CatchScreenTray.EXE_2|desktoptool.EXE_2|DTCrashReport.EXE_2|dtfilm.EXE_2|DTQuickInstProxy.EXE_2|dtwebbrowser.EXE_2|DumpReport.EXE_2|flashApp.EXE_2|GBInst.EXE_2|ImportFavHelper.EXE_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:43.364913940 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:43 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:43.411056995 CET863OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=dtswitcher.DLL_2|dtswitcher64.DLL_2|dtwebframe.DLL_2|ExtNetIncrement.DLL_2|GameBox.DLL_2|GameBoxCore.DLL_2|img_reader.DLL_2|LiveUpd360.DLL_2|MsgBox.DLL_2|NotifyDown.DLL_2|PDown.DLL_2|RegularShutdown.DLL_2|Safelive.DLL_2|Shell360dt.DLL_2|Shell360dt64.DLL_2|SMWebProxydt.DLL_2|SoftMgrLiteBase.DLL_2|somcoredt.DLL_2|somkernldt.DLL_2|somQuickInstdt.DLL_2|SomSoftMgrdt.DLL_2|sqlite3.DLL_2|UiFeature360Control.DLL_2|UiFeatureKernel.DLL_2|UiPluginCake.DLL_2|urlproc.DLL_2|urlprocnet.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:43.723146915 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:43 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:43.731295109 CET389OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=10&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7395&r3=1280x1024 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:44.043236017 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:43 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:44.056545973 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=11&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=9384 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:44.368494987 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:44 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:47.651221037 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=22394 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:47.963289976 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:47 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:55.510549068 CET376OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=2&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=15343 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:55.822606087 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:55 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:09:19 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a40f-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      17192.168.2.549805171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:27.609848976 CET940OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=21446&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:27.926127911 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:27 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:27 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cb-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:27.929008007 CET382OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=228113&r2=22263 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:28.246242046 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:28 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Mon, 29 Oct 2018 06:12:27 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5bd6a4cb-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      18192.168.2.549806101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:28.103336096 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:37:28.443032026 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:28 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:32:04 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d284-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      19192.168.2.549807101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:28.853404045 CET180OUTGET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:37:29.175544977 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:29 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:46 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d272-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                      20192.168.2.549808171.8.167.89806196C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:43.414524078 CET939OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=810&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=0&r2=7343&ext=LiveUpdate360.EXE_2|MusicIEFrame.EXE_2|oauthlogin.EXE_2|RegSMWebProxy.EXE_2|SetupUtilDT.EXE_2|Uninstall.EXE_2|UpdateTool.EXE_2|360Apns.DLL_2|360Common.DLL_2|360DesktopAssistant.DLL_2|360DesktopMenu.DLL_2|360DesktopUi.DLL_2|360DTFence.DLL_2|360DTSwitchBar.DLL_2|360Login.DLL_2|360MsgPushCore.DLL_2|360net.DLL_2|360NetUL.DLL_2|360P2SP.DLL_2|360Ver.DLL_2|360verify.DLL_2|360ZMUDetail.DLL_2|AppCenterCore.DLL_2|AppcenterData.DLL_2|AppcenterDataGb.DLL_2|AppUpdate.DLL_2|BizPluginCake.DLL_2|BoxUI.DLL_2|CloudTaskCenter_naive.DLL_2|dtappcore.DLL_2|DTShutdown.DLL_2 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:43.736601114 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:43 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes
                                                                                                                                                                                      Dec 29, 2023 00:37:43.748078108 CET381OUTGET /dt/s.htm?pid=h_home&fun=inst&act=1000&res=13&mid=59cd53708ed730f0ef42bb01f668d936&ver=2.6.0.1110&r1=254324&r2=9077 HTTP/1.1
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                      Dec 29, 2023 00:37:44.070405006 CET240INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:43 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 23 Jul 2019 07:37:53 GMT
                                                                                                                                                                                      Connection: keep-alive
                                                                                                                                                                                      ETag: "5d36b951-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      21192.168.2.549809101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:44.048813105 CET180OUTGET /bizhi/s.html?action=wpinst&from=0&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:37:44.369198084 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:44 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:32:04 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d284-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                      22192.168.2.549810101.198.2.14780
                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                      Dec 29, 2023 00:37:44.775177002 CET180OUTGET /bizhi/s.html?action=wpinst&from=2&appver=2.1.0.1026&pid=zhuomian&m=59cd53708ed730f0ef42bb01f668d936 HTTP/1.0
                                                                                                                                                                                      Host: s.360.cn
                                                                                                                                                                                      User-Agent: NSISDL/1.2 (Mozilla)
                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                      Dec 29, 2023 00:37:45.077395916 CET235INHTTP/1.1 200 OK
                                                                                                                                                                                      Server: openresty/1.15.8.2
                                                                                                                                                                                      Date: Thu, 28 Dec 2023 23:37:44 GMT
                                                                                                                                                                                      Content-Type: text/html
                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                      Last-Modified: Tue, 31 May 2022 08:31:21 GMT
                                                                                                                                                                                      Connection: close
                                                                                                                                                                                      ETag: "6295d259-0"
                                                                                                                                                                                      Accept-Ranges: bytes


                                                                                                                                                                                      Statistics

                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                      Behavior

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      System Behavior

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                      Start time:00:34:49
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe
                                                                                                                                                                                      Imagebase:0x6d0000
                                                                                                                                                                                      File size:22'004'296 bytes
                                                                                                                                                                                      MD5 hash:AAE3EEDBDC1B1A99F7C2844F85352692
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                      Start time:00:35:00
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                      Start time:00:35:00
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                      Start time:00:35:00
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                      Start time:00:35:30
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\modules\360TopbarASS.exe"
                                                                                                                                                                                      Imagebase:0xae0000
                                                                                                                                                                                      File size:256'872 bytes
                                                                                                                                                                                      MD5 hash:DEC58427DAFCCF050DA9AC893E28407C
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                      Start time:00:35:32
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                      Start time:00:35:32
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                      Start time:00:35:33
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                      Start time:00:35:33
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline: /s "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                      Imagebase:0x7ff71dee0000
                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                      Start time:00:35:33
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S
                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                      File size:1'412'584 bytes
                                                                                                                                                                                      MD5 hash:32DC2FA6DB8B8809B12A8CAD215C69FD
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                      Start time:00:35:33
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian
                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                      File size:1'746'672 bytes
                                                                                                                                                                                      MD5 hash:02C91D3BE856789E1711C37649F382CC
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                      Start time:00:35:34
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\Bin\flashApp.exe" onlyimport
                                                                                                                                                                                      Imagebase:0x1d0000
                                                                                                                                                                                      File size:385'200 bytes
                                                                                                                                                                                      MD5 hash:28580334E670277D005E38D4C9E65CFD
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:20
                                                                                                                                                                                      Start time:00:35:35
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                      Imagebase:0x7ff674740000
                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:22
                                                                                                                                                                                      Start time:00:35:40
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\Bin\360TopBar.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\Bin\360Topbar.exe" /autorun
                                                                                                                                                                                      Imagebase:0x200000
                                                                                                                                                                                      File size:206'000 bytes
                                                                                                                                                                                      MD5 hash:B70E8845A3DFB674910975E6D0C061EC
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:23
                                                                                                                                                                                      Start time:00:35:41
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 1028 -s 10624
                                                                                                                                                                                      Imagebase:0x7ff7ca110000
                                                                                                                                                                                      File size:570'736 bytes
                                                                                                                                                                                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:24
                                                                                                                                                                                      Start time:00:35:44
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:explorer.exe
                                                                                                                                                                                      Imagebase:0x7ff674740000
                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:26
                                                                                                                                                                                      Start time:00:35:48
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\360\360Desktop\Bin\360DesktopSwitch64.exe" /unloaddtswitcher
                                                                                                                                                                                      Imagebase:0x7ff680ae0000
                                                                                                                                                                                      File size:163'968 bytes
                                                                                                                                                                                      MD5 hash:476B86E7D05550919702E25541927DA5
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:28
                                                                                                                                                                                      Start time:00:35:49
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 1784 -s 4932
                                                                                                                                                                                      Imagebase:0x7ff7ca110000
                                                                                                                                                                                      File size:570'736 bytes
                                                                                                                                                                                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:29
                                                                                                                                                                                      Start time:00:35:51
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:explorer.exe
                                                                                                                                                                                      Imagebase:0x7ff674740000
                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:30
                                                                                                                                                                                      Start time:00:35:52
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:31
                                                                                                                                                                                      Start time:00:35:52
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline: /s /u "C:\Program Files (x86)\360\360Desktop\Bin\Shell360dt64.dll"
                                                                                                                                                                                      Imagebase:0x7ff71dee0000
                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:32
                                                                                                                                                                                      Start time:00:35:52
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\SMWebProxydt.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:34
                                                                                                                                                                                      Start time:00:35:54
                                                                                                                                                                                      Start date:29/12/2023
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\360\360Desktop\Bin\360DesktopMenu.dll"
                                                                                                                                                                                      Imagebase:0x650000
                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      Disassembly

                                                                                                                                                                                      Reset < >

                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                        Function 03491639 Relevance: 2.8, Strings: 1, Instructions: 1550COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03491000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: /
                                                                                                                                                                                        • API String ID: 0-2043925204
                                                                                                                                                                                        • Opcode ID: cb5b402883d6f5fad32fc762957632335cccc032fc9f1f8efd5c4e41731b5b6d
                                                                                                                                                                                        • Instruction ID: 8e5aa88bcbea6033e36dad9cfd91d40045709eac116a1736db7cefdbc7d36444
                                                                                                                                                                                        • Opcode Fuzzy Hash: cb5b402883d6f5fad32fc762957632335cccc032fc9f1f8efd5c4e41731b5b6d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8AA22D9140E7D14FD7239B7898BA6823FB09E27124B4E45CBC4C5CF5A7D50CAA1ACB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03491639 Relevance: 2.8, Strings: 1, Instructions: 1550COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: /
                                                                                                                                                                                        • API String ID: 0-2043925204
                                                                                                                                                                                        • Opcode ID: cb5b402883d6f5fad32fc762957632335cccc032fc9f1f8efd5c4e41731b5b6d
                                                                                                                                                                                        • Instruction ID: 8e5aa88bcbea6033e36dad9cfd91d40045709eac116a1736db7cefdbc7d36444
                                                                                                                                                                                        • Opcode Fuzzy Hash: cb5b402883d6f5fad32fc762957632335cccc032fc9f1f8efd5c4e41731b5b6d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8AA22D9140E7D14FD7239B7898BA6823FB09E27124B4E45CBC4C5CF5A7D50CAA1ACB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03491639 Relevance: 2.8, Strings: 1, Instructions: 1550COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0348E000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: /
                                                                                                                                                                                        • API String ID: 0-2043925204
                                                                                                                                                                                        • Opcode ID: cb5b402883d6f5fad32fc762957632335cccc032fc9f1f8efd5c4e41731b5b6d
                                                                                                                                                                                        • Instruction ID: 8e5aa88bcbea6033e36dad9cfd91d40045709eac116a1736db7cefdbc7d36444
                                                                                                                                                                                        • Opcode Fuzzy Hash: cb5b402883d6f5fad32fc762957632335cccc032fc9f1f8efd5c4e41731b5b6d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8AA22D9140E7D14FD7239B7898BA6823FB09E27124B4E45CBC4C5CF5A7D50CAA1ACB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0347BE96 Relevance: 2.7, Strings: 1, Instructions: 1416COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: /
                                                                                                                                                                                        • API String ID: 0-2043925204
                                                                                                                                                                                        • Opcode ID: f1c5c8eed261088b78d3cd95d3f97ab77f6bf7d3e5362ff619d39bff5ac006a7
                                                                                                                                                                                        • Instruction ID: 73d8dfd3f1283213a96deb86a04e2709bc8433140577d7beb87fb54b2abac1a5
                                                                                                                                                                                        • Opcode Fuzzy Hash: f1c5c8eed261088b78d3cd95d3f97ab77f6bf7d3e5362ff619d39bff5ac006a7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1AB2799680E7D15FD70387749CBA6807FB0AE23208B1E86DBC4C5CF5A3E219595AC763
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034923F9 Relevance: 1.9, Instructions: 1879COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03491000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: fbfda2715cdcd9b87a5148cd85ed862e62a00362a4691bfb57cff8eb3a02f9c5
                                                                                                                                                                                        • Instruction ID: 1631a3ec64be9f3b9825bb06e9938b0f4f9b5bf51dec3e13f3ca63286f108580
                                                                                                                                                                                        • Opcode Fuzzy Hash: fbfda2715cdcd9b87a5148cd85ed862e62a00362a4691bfb57cff8eb3a02f9c5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BD2419644E7D11FD7138B789CBA6817FB09E27114B0E86CBC4C8CF5A3D6099A1AC723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034923F9 Relevance: 1.9, Instructions: 1879COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: fbfda2715cdcd9b87a5148cd85ed862e62a00362a4691bfb57cff8eb3a02f9c5
                                                                                                                                                                                        • Instruction ID: 1631a3ec64be9f3b9825bb06e9938b0f4f9b5bf51dec3e13f3ca63286f108580
                                                                                                                                                                                        • Opcode Fuzzy Hash: fbfda2715cdcd9b87a5148cd85ed862e62a00362a4691bfb57cff8eb3a02f9c5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BD2419644E7D11FD7138B789CBA6817FB09E27114B0E86CBC4C8CF5A3D6099A1AC723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034923F9 Relevance: 1.9, Instructions: 1879COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0348E000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: fbfda2715cdcd9b87a5148cd85ed862e62a00362a4691bfb57cff8eb3a02f9c5
                                                                                                                                                                                        • Instruction ID: 1631a3ec64be9f3b9825bb06e9938b0f4f9b5bf51dec3e13f3ca63286f108580
                                                                                                                                                                                        • Opcode Fuzzy Hash: fbfda2715cdcd9b87a5148cd85ed862e62a00362a4691bfb57cff8eb3a02f9c5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BD2419644E7D11FD7138B789CBA6817FB09E27114B0E86CBC4C8CF5A3D6099A1AC723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0347FFE9 Relevance: 1.6, Instructions: 1618COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: b29f1925ec72cb194896b0695f3acb157c5666312516a5295f821f369b6a1548
                                                                                                                                                                                        • Instruction ID: 81931bb827b0963bc1515139ef0d561bd48f18ac78743cc6ab1fa15848d2c6bc
                                                                                                                                                                                        • Opcode Fuzzy Hash: b29f1925ec72cb194896b0695f3acb157c5666312516a5295f821f369b6a1548
                                                                                                                                                                                        • Instruction Fuzzy Hash: 08A23F9240E3D15FD7638B7888B96813FB09E27114B4E46DBC4C9CF5A7D518AA0ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03488A18 Relevance: .8, Instructions: 800COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 3bf0303a639f0497ea4cdb46ce291e14d9a12a7a90776e60058fffac9d67526d
                                                                                                                                                                                        • Instruction ID: de0db70c162121de34ceb5b77fee3b778036699c84645c8704eb003147ad9177
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3bf0303a639f0497ea4cdb46ce291e14d9a12a7a90776e60058fffac9d67526d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A424D9640E7D15FD7638BB888B96823FB05E27014B4E41CBC4C9CF5A7D508AA1EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03488A18 Relevance: .8, Instructions: 799COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 774e3201ec59554e03971f68eb3a8df725bbc9c963371f26e87abac7b2073e97
                                                                                                                                                                                        • Instruction ID: f5e321db65d4b98319bceb06cf493fc6590d0717b33ac3e57f70900ad8e5d8b2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 774e3201ec59554e03971f68eb3a8df725bbc9c963371f26e87abac7b2073e97
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C424D9640E3D15FD7638BB888B96823FB05E27014B4E41CBC4C9CF5A7D508AA1EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03488A18 Relevance: .8, Instructions: 799COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 774e3201ec59554e03971f68eb3a8df725bbc9c963371f26e87abac7b2073e97
                                                                                                                                                                                        • Instruction ID: f5e321db65d4b98319bceb06cf493fc6590d0717b33ac3e57f70900ad8e5d8b2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 774e3201ec59554e03971f68eb3a8df725bbc9c963371f26e87abac7b2073e97
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C424D9640E3D15FD7638BB888B96823FB05E27014B4E41CBC4C9CF5A7D508AA1EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034849A0 Relevance: .6, Instructions: 640COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: f7d680681cdf720bc03843498e443a7ffb0c5da4474e4493614319a9a3217c42
                                                                                                                                                                                        • Instruction ID: eeb6aa53df6bd4c543bb9def6c44caad07ad51b939143d63776b8282a103340b
                                                                                                                                                                                        • Opcode Fuzzy Hash: f7d680681cdf720bc03843498e443a7ffb0c5da4474e4493614319a9a3217c42
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E123EA144E7D15FD7138BB898A56913FB09E27124B0E46CBC4C8CF5A7D50CAA5ECB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034849A0 Relevance: .6, Instructions: 640COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: f7d680681cdf720bc03843498e443a7ffb0c5da4474e4493614319a9a3217c42
                                                                                                                                                                                        • Instruction ID: eeb6aa53df6bd4c543bb9def6c44caad07ad51b939143d63776b8282a103340b
                                                                                                                                                                                        • Opcode Fuzzy Hash: f7d680681cdf720bc03843498e443a7ffb0c5da4474e4493614319a9a3217c42
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E123EA144E7D15FD7138BB898A56913FB09E27124B0E46CBC4C8CF5A7D50CAA5ECB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489A31 Relevance: .5, Instructions: 498COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: b4d9d6e3b4df5c775ee851ffd362f7c6c4a44d824d6d107f32d465358420aa9f
                                                                                                                                                                                        • Instruction ID: 433005743431d1c6d037716f467ba9d3a24d2f6a2adce86c4d1cb2424ad09411
                                                                                                                                                                                        • Opcode Fuzzy Hash: b4d9d6e3b4df5c775ee851ffd362f7c6c4a44d824d6d107f32d465358420aa9f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 18E13D9500E7D14FD7639B7888B96813FB09E27120B4E56CBC0C5CF5A7C908AA1ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489A31 Relevance: .5, Instructions: 498COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: b4d9d6e3b4df5c775ee851ffd362f7c6c4a44d824d6d107f32d465358420aa9f
                                                                                                                                                                                        • Instruction ID: 433005743431d1c6d037716f467ba9d3a24d2f6a2adce86c4d1cb2424ad09411
                                                                                                                                                                                        • Opcode Fuzzy Hash: b4d9d6e3b4df5c775ee851ffd362f7c6c4a44d824d6d107f32d465358420aa9f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 18E13D9500E7D14FD7639B7888B96813FB09E27120B4E56CBC0C5CF5A7C908AA1ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489A31 Relevance: .5, Instructions: 497COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 01b21de296f0df0123631d860b8212b1d7c319dbf6d47effcfa8ece8ef3f7eb7
                                                                                                                                                                                        • Instruction ID: 3ea44cca6257ffc2209c0c816aaff66ffa1ebf72ee0f77d4a824a7cfb92161e4
                                                                                                                                                                                        • Opcode Fuzzy Hash: 01b21de296f0df0123631d860b8212b1d7c319dbf6d47effcfa8ece8ef3f7eb7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 68E13D9500E7D14FD7639B7888B96813FB09E27120B4E56CBC0C5CF5A7C908AA1EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034AA422 Relevance: .5, Instructions: 495COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A5000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 473d3b33af6d61723ef1c83ac5a9e59cfa5ef6ed77a2df315fcb8e2f0b8cc44f
                                                                                                                                                                                        • Instruction ID: 1069b46e362f6c907bf0cb97c34ddd075307eaaaaba3fd7234563d474506e8e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 473d3b33af6d61723ef1c83ac5a9e59cfa5ef6ed77a2df315fcb8e2f0b8cc44f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DE14E6419E7D05FD793977898A92857FB5AE03120B0E86EBC4C4CF4ABD218294EC733
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034AA422 Relevance: .5, Instructions: 495COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A4000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 473d3b33af6d61723ef1c83ac5a9e59cfa5ef6ed77a2df315fcb8e2f0b8cc44f
                                                                                                                                                                                        • Instruction ID: 1069b46e362f6c907bf0cb97c34ddd075307eaaaaba3fd7234563d474506e8e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 473d3b33af6d61723ef1c83ac5a9e59cfa5ef6ed77a2df315fcb8e2f0b8cc44f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DE14E6419E7D05FD793977898A92857FB5AE03120B0E86EBC4C4CF4ABD218294EC733
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034AA422 Relevance: .5, Instructions: 495COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A8000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 473d3b33af6d61723ef1c83ac5a9e59cfa5ef6ed77a2df315fcb8e2f0b8cc44f
                                                                                                                                                                                        • Instruction ID: 1069b46e362f6c907bf0cb97c34ddd075307eaaaaba3fd7234563d474506e8e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 473d3b33af6d61723ef1c83ac5a9e59cfa5ef6ed77a2df315fcb8e2f0b8cc44f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DE14E6419E7D05FD793977898A92857FB5AE03120B0E86EBC4C4CF4ABD218294EC733
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0347D99D Relevance: .4, Instructions: 428COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0f11d79fd620289e0ba5c816fe61100c09432a12e399ac9b5d1f234873d7102d
                                                                                                                                                                                        • Instruction ID: ebb740d56d2a4d5bfdaf1769c7a27b2e859c001260266bcf8e697b8305dbeb48
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0f11d79fd620289e0ba5c816fe61100c09432a12e399ac9b5d1f234873d7102d
                                                                                                                                                                                        • Instruction Fuzzy Hash: BBE177A640E7C15FD7138B788CB66817FB0AE27208B0E45DBC4C5CF5A7D219A91AC763
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A6A9C Relevance: .4, Instructions: 366COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A5000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 5b61c35ae184853943731769d8d6e9662da08584c43e8429d27637e9a592f754
                                                                                                                                                                                        • Instruction ID: 362a7a5276f6d79ceaa4de7fa983bca6735ae211fca588b8f61c20a7a257b546
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b61c35ae184853943731769d8d6e9662da08584c43e8429d27637e9a592f754
                                                                                                                                                                                        • Instruction Fuzzy Hash: F2C13E3144EBC18FD31B8B74C9A55817F70EE5322435F86CEC4868F9A3D26DA94AC762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A6A9C Relevance: .4, Instructions: 366COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A4000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 5b61c35ae184853943731769d8d6e9662da08584c43e8429d27637e9a592f754
                                                                                                                                                                                        • Instruction ID: 362a7a5276f6d79ceaa4de7fa983bca6735ae211fca588b8f61c20a7a257b546
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b61c35ae184853943731769d8d6e9662da08584c43e8429d27637e9a592f754
                                                                                                                                                                                        • Instruction Fuzzy Hash: F2C13E3144EBC18FD31B8B74C9A55817F70EE5322435F86CEC4868F9A3D26DA94AC762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0348D88F Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: bd035caa3fe8eb9c21f5b08c4efc0241a69f8a4ac5c92b77b9a1b570848bfa2b
                                                                                                                                                                                        • Instruction ID: 96109f88862fcfaf5f8a49a67c88118a8ca9586c5cafe3d0031395b6e59c71b7
                                                                                                                                                                                        • Opcode Fuzzy Hash: bd035caa3fe8eb9c21f5b08c4efc0241a69f8a4ac5c92b77b9a1b570848bfa2b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9DA130A640E7D19FC7239B7888B56913FB49E27110B4E05CBC0C4CF5A7C618AA1EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034AA147 Relevance: .3, Instructions: 329COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A5000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: bc5ff84893564dd019397821aee46645c1ce14f987b70aa523197f2d7e234b2c
                                                                                                                                                                                        • Instruction ID: 029e7fe4a18f8322416ea6f2140ac8742cae9c3f760e978c83f60ec00a285042
                                                                                                                                                                                        • Opcode Fuzzy Hash: bc5ff84893564dd019397821aee46645c1ce14f987b70aa523197f2d7e234b2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36A1412119E7D45FC753977898A46857FB1AE47120B0E86EBC4C4CF8ABD62C1C4AD723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034AA147 Relevance: .3, Instructions: 329COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A4000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: bc5ff84893564dd019397821aee46645c1ce14f987b70aa523197f2d7e234b2c
                                                                                                                                                                                        • Instruction ID: 029e7fe4a18f8322416ea6f2140ac8742cae9c3f760e978c83f60ec00a285042
                                                                                                                                                                                        • Opcode Fuzzy Hash: bc5ff84893564dd019397821aee46645c1ce14f987b70aa523197f2d7e234b2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36A1412119E7D45FC753977898A46857FB1AE47120B0E86EBC4C4CF8ABD62C1C4AD723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034AA147 Relevance: .3, Instructions: 329COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A8000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: bc5ff84893564dd019397821aee46645c1ce14f987b70aa523197f2d7e234b2c
                                                                                                                                                                                        • Instruction ID: 029e7fe4a18f8322416ea6f2140ac8742cae9c3f760e978c83f60ec00a285042
                                                                                                                                                                                        • Opcode Fuzzy Hash: bc5ff84893564dd019397821aee46645c1ce14f987b70aa523197f2d7e234b2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36A1412119E7D45FC753977898A46857FB1AE47120B0E86EBC4C4CF8ABD62C1C4AD723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0341A669 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2049372168.0000000003418000.00000004.00000020.00020000.00000000.sdmp, Offset: 03418000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_3418000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: fce4d623e128956d75ac173960ff89023c23534f3d9c88343ba0d68cde43287f
                                                                                                                                                                                        • Instruction ID: fbf0219b9a92d43f1bedc385fae9bf2726499982f6515fa7674ea028539cafaa
                                                                                                                                                                                        • Opcode Fuzzy Hash: fce4d623e128956d75ac173960ff89023c23534f3d9c88343ba0d68cde43287f
                                                                                                                                                                                        • Instruction Fuzzy Hash: E1A13E6518E3D09FDB938B7898A62817FB0AE0312070E45EBC4C4CF5ABD619185EDB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0348260F Relevance: .3, Instructions: 323COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 6add8ab2c54a342fef2ae99b292bcd5523fe2d4f3fb43f62bec16cc9c10681a5
                                                                                                                                                                                        • Instruction ID: 819ec70ff1c593fa146e69a188b072b7be2bc4da6f80da7ac256bcf1f4b1b050
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6add8ab2c54a342fef2ae99b292bcd5523fe2d4f3fb43f62bec16cc9c10681a5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0AA10D9100E7E14FD7638BB888B96813FB09E27114B4E45DBC4C8CF5A7C409A95EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0348D518 Relevance: .3, Instructions: 309COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: d5f1dc38cfd3ddf9deb74732b0d192d29b0bf8c972dcd107520073ae0c95fb3b
                                                                                                                                                                                        • Instruction ID: d44e22c7a7fc8fe2e450f2983ed420d9af0e22040bb804fd1cf9e9262c4bef3e
                                                                                                                                                                                        • Opcode Fuzzy Hash: d5f1dc38cfd3ddf9deb74732b0d192d29b0bf8c972dcd107520073ae0c95fb3b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 65A14E5240E7D15FC7138B789CBA6917FB06E27110B4E86CBC4C5CF4A3D648AA4ACB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034863D8 Relevance: .3, Instructions: 255COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: c67b3c7bdd836981c04f768bdfeb1af4e5e1cf78ef3630b9ae08acf761bcc7b2
                                                                                                                                                                                        • Instruction ID: a95de47f3bc14ac2a3bc3c959e12d7eef0988d7b0bd08fd37c4aa7bfeb198389
                                                                                                                                                                                        • Opcode Fuzzy Hash: c67b3c7bdd836981c04f768bdfeb1af4e5e1cf78ef3630b9ae08acf761bcc7b2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B714E9204E7D04FD7639BB888A56913FB48E27124B4E06CBC0D4CF5A7C51CAA1EDB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034863D8 Relevance: .3, Instructions: 255COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: c67b3c7bdd836981c04f768bdfeb1af4e5e1cf78ef3630b9ae08acf761bcc7b2
                                                                                                                                                                                        • Instruction ID: a95de47f3bc14ac2a3bc3c959e12d7eef0988d7b0bd08fd37c4aa7bfeb198389
                                                                                                                                                                                        • Opcode Fuzzy Hash: c67b3c7bdd836981c04f768bdfeb1af4e5e1cf78ef3630b9ae08acf761bcc7b2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B714E9204E7D04FD7639BB888A56913FB48E27124B4E06CBC0D4CF5A7C51CAA1EDB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489E88 Relevance: .2, Instructions: 235COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 719ac278467d4a10d01a3101d7212fd3a3aa661cbf06f2cd2a2a7361997bcd57
                                                                                                                                                                                        • Instruction ID: 3f8bb2d8f5feec4df9d8236bbd58474997bc83d072f7fa9e9de7ea92a33f63fb
                                                                                                                                                                                        • Opcode Fuzzy Hash: 719ac278467d4a10d01a3101d7212fd3a3aa661cbf06f2cd2a2a7361997bcd57
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE611D9644E3D04FC7638BB898A96813FB44E27114B4E51CBC0C9CF5A7D80C6A0EDB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489E88 Relevance: .2, Instructions: 235COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 3c5256a90aa825144fb534ed249a217ebc14ad6bbc598ef7ee573bb36901163e
                                                                                                                                                                                        • Instruction ID: f9583222e525d9a283e34935e14f91c3310f5dc1b4de3e71ab820ccf5cabdeff
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c5256a90aa825144fb534ed249a217ebc14ad6bbc598ef7ee573bb36901163e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B711D6644E3D04FC7638BB898A96813FB09E6712074E45CBC0C9CF5A7D90D6A0EDB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489E88 Relevance: .2, Instructions: 235COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 3c5256a90aa825144fb534ed249a217ebc14ad6bbc598ef7ee573bb36901163e
                                                                                                                                                                                        • Instruction ID: f9583222e525d9a283e34935e14f91c3310f5dc1b4de3e71ab820ccf5cabdeff
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c5256a90aa825144fb534ed249a217ebc14ad6bbc598ef7ee573bb36901163e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B711D6644E3D04FC7638BB898A96813FB09E6712074E45CBC0C9CF5A7D90D6A0EDB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0341A938 Relevance: .2, Instructions: 230COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2049372168.0000000003418000.00000004.00000020.00020000.00000000.sdmp, Offset: 03418000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_3418000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 3bb4074280cce4bd83be6e9ed6ce679b1cf1a10b016fe98550063c310365dc05
                                                                                                                                                                                        • Instruction ID: 653b877637a01fbd1f86592adc1eb3cbdcef5324cef993d06e0adf57cac87e2f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3bb4074280cce4bd83be6e9ed6ce679b1cf1a10b016fe98550063c310365dc05
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8461636515F3D55FE7579B7888A62817FB0AE07220B0E48DBC4C1CF1ABD628585ECB23
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489709 Relevance: .2, Instructions: 225COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0db7722b4d7ec15b25018042cb282db267136b278f58b0562355c439e9476c9c
                                                                                                                                                                                        • Instruction ID: ea106b58215732b0dda5e02432ed4111781b77ea09462e6adbf59e37ed352bd5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0db7722b4d7ec15b25018042cb282db267136b278f58b0562355c439e9476c9c
                                                                                                                                                                                        • Instruction Fuzzy Hash: BF512C5500E7D15FD7538BB898BA6813FB48E27024B0E45CBC0C8CF1A3C509AA1ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489709 Relevance: .2, Instructions: 225COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0db7722b4d7ec15b25018042cb282db267136b278f58b0562355c439e9476c9c
                                                                                                                                                                                        • Instruction ID: ea106b58215732b0dda5e02432ed4111781b77ea09462e6adbf59e37ed352bd5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0db7722b4d7ec15b25018042cb282db267136b278f58b0562355c439e9476c9c
                                                                                                                                                                                        • Instruction Fuzzy Hash: BF512C5500E7D15FD7538BB898BA6813FB48E27024B0E45CBC0C8CF1A3C509AA1ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03489709 Relevance: .2, Instructions: 225COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0db7722b4d7ec15b25018042cb282db267136b278f58b0562355c439e9476c9c
                                                                                                                                                                                        • Instruction ID: ea106b58215732b0dda5e02432ed4111781b77ea09462e6adbf59e37ed352bd5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0db7722b4d7ec15b25018042cb282db267136b278f58b0562355c439e9476c9c
                                                                                                                                                                                        • Instruction Fuzzy Hash: BF512C5500E7D15FD7538BB898BA6813FB48E27024B0E45CBC0C8CF1A3C509AA1ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A61AE Relevance: .2, Instructions: 211COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A5000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: a9c5abbd6eb444ef1dd7adb64e48359983a4d4c207847e0a5016b64ad3a0cf9b
                                                                                                                                                                                        • Instruction ID: d8a8f397ae63967dd5b7c2e36ca2c6fce2b307016453a375f0359873d99f9e8e
                                                                                                                                                                                        • Opcode Fuzzy Hash: a9c5abbd6eb444ef1dd7adb64e48359983a4d4c207847e0a5016b64ad3a0cf9b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C716C2244EBC04FD717CB7488A59847F70FE5322035F86CEC4868F9A3D26DA85AD762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A61AE Relevance: .2, Instructions: 211COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A4000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: a9c5abbd6eb444ef1dd7adb64e48359983a4d4c207847e0a5016b64ad3a0cf9b
                                                                                                                                                                                        • Instruction ID: d8a8f397ae63967dd5b7c2e36ca2c6fce2b307016453a375f0359873d99f9e8e
                                                                                                                                                                                        • Opcode Fuzzy Hash: a9c5abbd6eb444ef1dd7adb64e48359983a4d4c207847e0a5016b64ad3a0cf9b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C716C2244EBC04FD717CB7488A59847F70FE5322035F86CEC4868F9A3D26DA85AD762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0347D7A7 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 5b03aedaff443a651efcd9c517920804e6d5296b100a8fb61e26d700d0c60bf1
                                                                                                                                                                                        • Instruction ID: 539be2ba4961a060cdd12c6b9fba6071b44d2ffc96475a796c0709cc8e86bb27
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b03aedaff443a651efcd9c517920804e6d5296b100a8fb61e26d700d0c60bf1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 98513D9681E3D04FC7238B7888BA6823FB49E27104B4F45DBC0C9CF5A7D5085A1ACB67
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0347BC12 Relevance: .2, Instructions: 177COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 751439c42307b9f14b4ca5229038c14e1618485e5954d1d4e2ec79b30830280f
                                                                                                                                                                                        • Instruction ID: 88dbf611d28e0a98aad9f577512610954c1d2982e786c7759ac9e51452afebe1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 751439c42307b9f14b4ca5229038c14e1618485e5954d1d4e2ec79b30830280f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E512D5110E7D05FDB638B7898B96823FB0AE67114B0E12CBC4D5CF5B7C219AA1AD723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034897B1 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03488000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 8d8b0ba8145e5051fc5342ec365b4311c1c25ba0f151b86325f7a6eca70a5ca6
                                                                                                                                                                                        • Instruction ID: 8c21f2efcaaa5de4b531ce7269fb8a6f61f4a762c261bf060cbb8a4c219fe548
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d8b0ba8145e5051fc5342ec365b4311c1c25ba0f151b86325f7a6eca70a5ca6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 04410B5600E7D15FD7638BB898B66813FB48E27124B0E55CBC0C8CF1A7C509AA5EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0347CBCA Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: c3d0793fade5f212a65faacfc7010c2754ad52cdabcf1b5ef5ec0fadc72b8196
                                                                                                                                                                                        • Instruction ID: 0ab625c5fec5d45e52dc30b6cfd1b26b5d1843dd2a12d89637ddb6156684f5a0
                                                                                                                                                                                        • Opcode Fuzzy Hash: c3d0793fade5f212a65faacfc7010c2754ad52cdabcf1b5ef5ec0fadc72b8196
                                                                                                                                                                                        • Instruction Fuzzy Hash: 13413E5110E3D05FD7238BB898B56823FB09E67110B0E46CBC0D5CF9A3C5186A1ECB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034897B1 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 8d8b0ba8145e5051fc5342ec365b4311c1c25ba0f151b86325f7a6eca70a5ca6
                                                                                                                                                                                        • Instruction ID: 8c21f2efcaaa5de4b531ce7269fb8a6f61f4a762c261bf060cbb8a4c219fe548
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d8b0ba8145e5051fc5342ec365b4311c1c25ba0f151b86325f7a6eca70a5ca6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 04410B5600E7D15FD7638BB898B66813FB48E27124B0E55CBC0C8CF1A7C509AA5EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034897B1 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051522731.0000000003488000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 8d8b0ba8145e5051fc5342ec365b4311c1c25ba0f151b86325f7a6eca70a5ca6
                                                                                                                                                                                        • Instruction ID: 8c21f2efcaaa5de4b531ce7269fb8a6f61f4a762c261bf060cbb8a4c219fe548
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d8b0ba8145e5051fc5342ec365b4311c1c25ba0f151b86325f7a6eca70a5ca6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 04410B5600E7D15FD7638BB898B66813FB48E27124B0E55CBC0C8CF1A7C509AA5EDB63
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034BA94E Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 0347A000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: c7da354dc99d839c32a6815d78fc6bdb3a84211fdc62232f136651e8c7e835a4
                                                                                                                                                                                        • Instruction ID: a118f6313cc5845b0beaf24eb0712be78151307963501d33cba7dc266a004673
                                                                                                                                                                                        • Opcode Fuzzy Hash: c7da354dc99d839c32a6815d78fc6bdb3a84211fdc62232f136651e8c7e835a4
                                                                                                                                                                                        • Instruction Fuzzy Hash: E6310B2819E7D51FDB539B7898A82817FB0AD0302030E86DBC8C5CF0ABC618490DD377
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034BA94E Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 03483000, based on PE: false
                                                                                                                                                                                        • Associated: 00000000.00000003.2051400091.000000000347A000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: c7da354dc99d839c32a6815d78fc6bdb3a84211fdc62232f136651e8c7e835a4
                                                                                                                                                                                        • Instruction ID: a118f6313cc5845b0beaf24eb0712be78151307963501d33cba7dc266a004673
                                                                                                                                                                                        • Opcode Fuzzy Hash: c7da354dc99d839c32a6815d78fc6bdb3a84211fdc62232f136651e8c7e835a4
                                                                                                                                                                                        • Instruction Fuzzy Hash: E6310B2819E7D51FDB539B7898A82817FB0AD0302030E86DBC8C5CF0ABC618490DD377
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A9F01 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A5000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 87342f76a3c4f46027dddf3b16c4f11873052abb08e670471454ec6431fe1a46
                                                                                                                                                                                        • Instruction ID: 3280d8fd30bebb2f18ee616fd43025e0b82aef5dfa39fc420a16e206689362fa
                                                                                                                                                                                        • Opcode Fuzzy Hash: 87342f76a3c4f46027dddf3b16c4f11873052abb08e670471454ec6431fe1a46
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5131322118E3D44FC7539778A8A52857FB4AE4322070E49DBC4C4CF4ABD2581D4EC723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A9F01 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A4000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 87342f76a3c4f46027dddf3b16c4f11873052abb08e670471454ec6431fe1a46
                                                                                                                                                                                        • Instruction ID: 3280d8fd30bebb2f18ee616fd43025e0b82aef5dfa39fc420a16e206689362fa
                                                                                                                                                                                        • Opcode Fuzzy Hash: 87342f76a3c4f46027dddf3b16c4f11873052abb08e670471454ec6431fe1a46
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5131322118E3D44FC7539778A8A52857FB4AE4322070E49DBC4C4CF4ABD2581D4EC723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 034A9F01 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000003.2051674791.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, Offset: 034A8000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_347a000_SecuriteInfo.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 87342f76a3c4f46027dddf3b16c4f11873052abb08e670471454ec6431fe1a46
                                                                                                                                                                                        • Instruction ID: 3280d8fd30bebb2f18ee616fd43025e0b82aef5dfa39fc420a16e206689362fa
                                                                                                                                                                                        • Opcode Fuzzy Hash: 87342f76a3c4f46027dddf3b16c4f11873052abb08e670471454ec6431fe1a46
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5131322118E3D44FC7539778A8A52857FB4AE4322070E49DBC4C4CF4ABD2581D4EC723
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                        Execution Coverage:6.2%
                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                        Signature Coverage:6.1%
                                                                                                                                                                                        Total number of Nodes:2000
                                                                                                                                                                                        Total number of Limit Nodes:84
                                                                                                                                                                                        execution_graph 17157 af227f 17194 af6ff8 17157->17194 17159 af228b GetStartupInfoW 17161 af22ae 17159->17161 17195 af6355 HeapCreate 17161->17195 17163 af22fe 17197 af75a7 GetModuleHandleW 17163->17197 17167 af230f __RTC_Initialize 17231 afc3d6 17167->17231 17168 af2256 _fast_error_exit 62 API calls 17168->17167 17170 af231d 17171 af2329 GetCommandLineW 17170->17171 17399 af7764 17170->17399 17246 afc379 GetEnvironmentStringsW 17171->17246 17175 af2338 17252 afc2cb GetModuleFileNameW 17175->17252 17177 af2342 17178 af234d 17177->17178 17179 af7764 __amsg_exit 62 API calls 17177->17179 17256 afc09c 17178->17256 17179->17178 17182 af235e 17269 af7823 17182->17269 17183 af7764 __amsg_exit 62 API calls 17183->17182 17185 af2365 17186 af7764 __amsg_exit 62 API calls 17185->17186 17187 af2370 __wwincmdln 17185->17187 17186->17187 17275 ae3070 17187->17275 17190 af239f 17406 af7a00 17190->17406 17193 af23a4 __free_locale 17194->17159 17196 af22f2 17195->17196 17196->17163 17391 af2256 17196->17391 17198 af75bb 17197->17198 17199 af75c2 17197->17199 17409 af7734 17198->17409 17201 af75cc GetProcAddress GetProcAddress GetProcAddress GetProcAddress 17199->17201 17202 af772a 17199->17202 17205 af7615 TlsAlloc 17201->17205 17468 af72c1 17202->17468 17207 af2304 17205->17207 17208 af7663 TlsSetValue 17205->17208 17207->17167 17207->17168 17208->17207 17209 af7674 17208->17209 17413 af7a1e 17209->17413 17214 af7197 __encode_pointer 6 API calls 17215 af7694 17214->17215 17216 af7197 __encode_pointer 6 API calls 17215->17216 17217 af76a4 17216->17217 17218 af7197 __encode_pointer 6 API calls 17217->17218 17219 af76b4 17218->17219 17430 af6385 17219->17430 17226 af7212 __decode_pointer 6 API calls 17227 af7708 17226->17227 17227->17202 17228 af770f 17227->17228 17450 af72fe 17228->17450 17230 af7717 GetCurrentThreadId 17230->17207 17775 af6ff8 17231->17775 17233 afc3e2 GetStartupInfoA 17234 af46ca __calloc_crt 62 API calls 17233->17234 17242 afc403 17234->17242 17235 afc621 __free_locale 17235->17170 17236 afc59e GetStdHandle 17241 afc568 17236->17241 17237 afc603 SetHandleCount 17237->17235 17238 af46ca __calloc_crt 62 API calls 17238->17242 17239 afc5b0 GetFileType 17239->17241 17240 afc4eb 17240->17235 17240->17241 17243 afc514 GetFileType 17240->17243 17245 b001ac __mtinitlocknum InitializeCriticalSectionAndSpinCount 17240->17245 17241->17235 17241->17236 17241->17237 17241->17239 17244 b001ac __mtinitlocknum InitializeCriticalSectionAndSpinCount 17241->17244 17242->17235 17242->17238 17242->17240 17242->17241 17243->17240 17244->17241 17245->17240 17247 afc38e 17246->17247 17248 afc38a 17246->17248 17249 af4685 __malloc_crt 62 API calls 17247->17249 17248->17175 17251 afc3af __setlocale_set_cat 17249->17251 17250 afc3b6 FreeEnvironmentStringsW 17250->17175 17251->17250 17254 afc300 _wparse_cmdline 17252->17254 17253 afc343 _wparse_cmdline 17253->17177 17254->17253 17255 af4685 __malloc_crt 62 API calls 17254->17255 17255->17253 17257 afc0b4 _wcslen 17256->17257 17260 af2353 17256->17260 17258 af46ca __calloc_crt 62 API calls 17257->17258 17259 afc0d8 _wcslen 17258->17259 17259->17260 17261 afc13d 17259->17261 17263 af46ca __calloc_crt 62 API calls 17259->17263 17264 afc163 17259->17264 17267 afc122 17259->17267 17776 b04251 17259->17776 17260->17182 17260->17183 17262 af108d __free_locale 62 API calls 17261->17262 17262->17260 17263->17259 17265 af108d __free_locale 62 API calls 17264->17265 17265->17260 17267->17259 17268 af11fb __invoke_watson 10 API calls 17267->17268 17268->17267 17270 af7831 __IsNonwritableInCurrentImage 17269->17270 17785 b0020c 17270->17785 17272 af784f __initterm_e 17274 af786e __IsNonwritableInCurrentImage __initterm 17272->17274 17789 af1a1c 17272->17789 17274->17185 17276 ae3105 _memset 17275->17276 17889 af00c0 17276->17889 17280 ae3143 17911 ae2f30 17280->17911 17282 ae314e 17283 ae4c60 74 API calls 17282->17283 17356 ae3152 ctype 17282->17356 17284 ae31d8 17283->17284 17927 ae4ac0 17284->17927 17287 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17289 ae3b67 17287->17289 17289->17190 17388 af79d4 17289->17388 17290 ae31fa 17291 ae4ac0 74 API calls 17290->17291 17292 ae320a 17291->17292 17949 ae4750 17292->17949 17294 ae3228 17963 ae6d20 17294->17963 17300 ae3258 17301 ae3a9c 17300->17301 17303 ae3270 17300->17303 17302 ae7130 InternetCloseHandle 17301->17302 17302->17356 17304 ae3283 17303->17304 18084 af1349 17303->18084 18087 ae3bd0 17304->18087 17356->17287 20518 af78a8 17388->20518 17390 af79e5 17390->17190 17392 af2269 17391->17392 17393 af2264 17391->17393 17394 af7a6c __NMSG_WRITE 62 API calls 17392->17394 17395 af7c17 __FF_MSGBANNER 62 API calls 17393->17395 17396 af2271 17394->17396 17395->17392 17397 af77b8 _doexit 3 API calls 17396->17397 17398 af227b 17397->17398 17398->17163 17400 af7c17 __FF_MSGBANNER 62 API calls 17399->17400 17401 af776e 17400->17401 17402 af7a6c __NMSG_WRITE 62 API calls 17401->17402 17403 af7776 17402->17403 17404 af7212 __decode_pointer 6 API calls 17403->17404 17405 af2328 17404->17405 17405->17171 17407 af78a8 _doexit 62 API calls 17406->17407 17408 af7a0b 17407->17408 17408->17193 17410 af773f Sleep GetModuleHandleW 17409->17410 17411 af775d 17410->17411 17412 af75c1 17410->17412 17411->17410 17411->17412 17412->17199 17474 af7209 17413->17474 17415 af7a26 __init_pointers __initp_misc_winsig 17477 afc790 17415->17477 17418 af7197 __encode_pointer 6 API calls 17419 af7679 17418->17419 17420 af7197 TlsGetValue 17419->17420 17421 af71af 17420->17421 17422 af71d0 GetModuleHandleW 17420->17422 17421->17422 17423 af71b9 TlsGetValue 17421->17423 17424 af71eb GetProcAddress 17422->17424 17425 af71e0 17422->17425 17428 af71c4 17423->17428 17427 af71c8 17424->17427 17426 af7734 __crt_waiting_on_module_handle 2 API calls 17425->17426 17429 af71e6 17426->17429 17427->17214 17428->17422 17428->17427 17429->17424 17429->17427 17433 af6390 17430->17433 17432 af63be 17432->17202 17434 af7212 TlsGetValue 17432->17434 17433->17432 17480 b001ac 17433->17480 17435 af724b GetModuleHandleW 17434->17435 17436 af722a 17434->17436 17438 af725b 17435->17438 17439 af7266 GetProcAddress 17435->17439 17436->17435 17437 af7234 TlsGetValue 17436->17437 17442 af723f 17437->17442 17440 af7734 __crt_waiting_on_module_handle 2 API calls 17438->17440 17441 af7243 17439->17441 17443 af7261 17440->17443 17441->17202 17444 af46ca 17441->17444 17442->17435 17442->17441 17443->17439 17443->17441 17446 af46d3 17444->17446 17447 af4710 17446->17447 17448 af46f1 Sleep 17446->17448 17485 affb56 17446->17485 17447->17202 17447->17226 17449 af4706 17448->17449 17449->17446 17449->17447 17754 af6ff8 17450->17754 17452 af730a GetModuleHandleW 17453 af731a 17452->17453 17454 af7320 17452->17454 17457 af7734 __crt_waiting_on_module_handle 2 API calls 17453->17457 17455 af735c 17454->17455 17456 af7338 GetProcAddress GetProcAddress 17454->17456 17458 af6501 __lock 58 API calls 17455->17458 17456->17455 17457->17454 17459 af737b InterlockedIncrement 17458->17459 17755 af73d3 17459->17755 17462 af6501 __lock 58 API calls 17463 af739c 17462->17463 17758 af2bcb InterlockedIncrement 17463->17758 17465 af73ba 17770 af73dc 17465->17770 17467 af73c7 __free_locale 17467->17230 17469 af72cb 17468->17469 17470 af72d7 17468->17470 17471 af7212 __decode_pointer 6 API calls 17469->17471 17472 af72eb TlsFree 17470->17472 17473 af72f9 17470->17473 17471->17470 17472->17473 17473->17473 17475 af7197 __encode_pointer 6 API calls 17474->17475 17476 af7210 17475->17476 17476->17415 17478 af7197 __encode_pointer 6 API calls 17477->17478 17479 af7a58 17478->17479 17479->17418 17484 af6ff8 17480->17484 17482 b001b8 InitializeCriticalSectionAndSpinCount 17483 b001fc __free_locale 17482->17483 17483->17433 17484->17482 17486 affb62 __free_locale 17485->17486 17487 affb7a 17486->17487 17497 affb99 _memset 17486->17497 17498 af47a6 17487->17498 17490 affc0b RtlAllocateHeap 17490->17497 17491 affb8f __free_locale 17491->17446 17497->17490 17497->17491 17504 af6501 17497->17504 17511 af6d13 17497->17511 17517 affc52 17497->17517 17520 af7167 17497->17520 17523 af73e5 GetLastError 17498->17523 17500 af47ab 17501 af1323 17500->17501 17502 af7212 __decode_pointer 6 API calls 17501->17502 17503 af1333 __invoke_watson 17502->17503 17505 af6529 EnterCriticalSection 17504->17505 17506 af6516 17504->17506 17505->17497 17548 af643e 17506->17548 17508 af651c 17508->17505 17509 af7764 __amsg_exit 61 API calls 17508->17509 17510 af6528 17509->17510 17510->17505 17512 af6d41 17511->17512 17513 af6dda 17512->17513 17515 af6de3 17512->17515 17742 af687a 17512->17742 17513->17515 17749 af692a 17513->17749 17515->17497 17753 af6427 LeaveCriticalSection 17517->17753 17519 affc59 17519->17497 17521 af7212 __decode_pointer 6 API calls 17520->17521 17522 af7177 17521->17522 17522->17497 17537 af728d TlsGetValue 17523->17537 17526 af7452 SetLastError 17526->17500 17527 af46ca __calloc_crt 59 API calls 17528 af7410 17527->17528 17528->17526 17529 af7212 __decode_pointer 6 API calls 17528->17529 17530 af742a 17529->17530 17531 af7449 17530->17531 17532 af7431 17530->17532 17542 af108d 17531->17542 17533 af72fe __initptd 59 API calls 17532->17533 17535 af7439 GetCurrentThreadId 17533->17535 17535->17526 17536 af744f 17536->17526 17538 af72bd 17537->17538 17539 af72a2 17537->17539 17538->17526 17538->17527 17540 af7212 __decode_pointer 6 API calls 17539->17540 17541 af72ad TlsSetValue 17540->17541 17541->17538 17543 af1099 __free_locale 17542->17543 17544 af1115 __free_locale 17543->17544 17545 af10ec HeapFree 17543->17545 17544->17536 17545->17544 17546 af10ff 17545->17546 17547 af47a6 __sopen_helper 61 API calls 17546->17547 17547->17544 17549 af644a __free_locale 17548->17549 17550 af6470 17549->17550 17574 af7c17 17549->17574 17558 af6480 __free_locale 17550->17558 17620 af4685 17550->17620 17556 af6492 17560 af47a6 __sopen_helper 62 API calls 17556->17560 17557 af64a1 17561 af6501 __lock 62 API calls 17557->17561 17558->17508 17560->17558 17563 af64a8 17561->17563 17564 af64dc 17563->17564 17565 af64b0 17563->17565 17566 af108d __free_locale 62 API calls 17564->17566 17567 b001ac __mtinitlocknum InitializeCriticalSectionAndSpinCount 17565->17567 17568 af64cd 17566->17568 17569 af64bb 17567->17569 17626 af64f8 17568->17626 17569->17568 17571 af108d __free_locale 62 API calls 17569->17571 17572 af64c7 17571->17572 17573 af47a6 __sopen_helper 62 API calls 17572->17573 17573->17568 17629 b003a5 17574->17629 17577 b003a5 __set_error_mode 62 API calls 17579 af7c2b 17577->17579 17578 af7a6c __NMSG_WRITE 62 API calls 17580 af7c43 17578->17580 17579->17578 17581 af645f 17579->17581 17582 af7a6c __NMSG_WRITE 62 API calls 17580->17582 17583 af7a6c 17581->17583 17582->17581 17584 af7a80 17583->17584 17585 b003a5 __set_error_mode 59 API calls 17584->17585 17616 af6466 17584->17616 17586 af7aa2 17585->17586 17587 af7be0 GetStdHandle 17586->17587 17589 b003a5 __set_error_mode 59 API calls 17586->17589 17588 af7bee _strlen 17587->17588 17587->17616 17592 af7c07 WriteFile 17588->17592 17588->17616 17590 af7ab3 17589->17590 17590->17587 17591 af7ac5 17590->17591 17591->17616 17635 af5f82 17591->17635 17592->17616 17595 af7afb GetModuleFileNameA 17596 af7b19 17595->17596 17601 af7b3c _strlen 17595->17601 17599 af5f82 _strcpy_s 59 API calls 17596->17599 17600 af7b29 17599->17600 17600->17601 17602 af11fb __invoke_watson 10 API calls 17600->17602 17612 af7b7f 17601->17612 17651 afd611 17601->17651 17602->17601 17606 af7ba3 17609 afd59d _strcat_s 59 API calls 17606->17609 17608 af11fb __invoke_watson 10 API calls 17608->17606 17611 af7bb7 17609->17611 17610 af11fb __invoke_watson 10 API calls 17610->17612 17613 af7bc8 17611->17613 17615 af11fb __invoke_watson 10 API calls 17611->17615 17660 afd59d 17612->17660 17669 b0023c 17613->17669 17615->17613 17617 af77b8 17616->17617 17707 af778d GetModuleHandleW 17617->17707 17622 af468e 17620->17622 17623 af46c4 17622->17623 17624 af46a5 Sleep 17622->17624 17711 af13a8 17622->17711 17623->17556 17623->17557 17625 af46ba 17624->17625 17625->17622 17625->17623 17741 af6427 LeaveCriticalSection 17626->17741 17628 af64ff 17628->17558 17632 b003b4 17629->17632 17630 af47a6 __sopen_helper 62 API calls 17633 b003d7 17630->17633 17631 af7c1e 17631->17577 17631->17579 17632->17630 17632->17631 17634 af1323 __sopen_helper 6 API calls 17633->17634 17634->17631 17636 af5f9a 17635->17636 17637 af5f93 17635->17637 17638 af47a6 __sopen_helper 62 API calls 17636->17638 17637->17636 17640 af5fc0 17637->17640 17643 af5f9f 17638->17643 17639 af1323 __sopen_helper 6 API calls 17641 af5fae 17639->17641 17640->17641 17642 af47a6 __sopen_helper 62 API calls 17640->17642 17641->17595 17644 af11fb 17641->17644 17642->17643 17643->17639 17696 af5ae0 17644->17696 17646 af1228 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17647 af1304 GetCurrentProcess TerminateProcess 17646->17647 17650 af12f8 __invoke_watson 17646->17650 17698 af0d52 17647->17698 17649 af1321 17649->17595 17650->17647 17655 afd623 17651->17655 17652 afd627 17653 af47a6 __sopen_helper 62 API calls 17652->17653 17654 af7b6c 17652->17654 17659 afd643 17653->17659 17654->17610 17654->17612 17655->17652 17655->17654 17657 afd66d 17655->17657 17656 af1323 __sopen_helper 6 API calls 17656->17654 17657->17654 17658 af47a6 __sopen_helper 62 API calls 17657->17658 17658->17659 17659->17656 17661 afd5b5 17660->17661 17664 afd5ae 17660->17664 17662 af47a6 __sopen_helper 62 API calls 17661->17662 17663 afd5ba 17662->17663 17665 af1323 __sopen_helper 6 API calls 17663->17665 17664->17661 17667 afd5e9 17664->17667 17666 af7b92 17665->17666 17666->17606 17666->17608 17667->17666 17668 af47a6 __sopen_helper 62 API calls 17667->17668 17668->17663 17670 af7209 _doexit 6 API calls 17669->17670 17671 b0024c 17670->17671 17672 b0025f LoadLibraryA 17671->17672 17677 b002e7 17671->17677 17673 b00274 GetProcAddress 17672->17673 17674 b00389 17672->17674 17673->17674 17675 b0028a 17673->17675 17674->17616 17678 af7197 __encode_pointer 6 API calls 17675->17678 17676 b00311 17680 af7212 __decode_pointer 6 API calls 17676->17680 17693 b0033c 17676->17693 17677->17676 17681 af7212 __decode_pointer 6 API calls 17677->17681 17683 b00290 GetProcAddress 17678->17683 17679 af7212 __decode_pointer 6 API calls 17679->17674 17689 b00354 17680->17689 17682 b00304 17681->17682 17684 af7212 __decode_pointer 6 API calls 17682->17684 17685 af7197 __encode_pointer 6 API calls 17683->17685 17684->17676 17686 b002a5 GetProcAddress 17685->17686 17687 af7197 __encode_pointer 6 API calls 17686->17687 17688 b002ba GetProcAddress 17687->17688 17690 af7197 __encode_pointer 6 API calls 17688->17690 17691 af7212 __decode_pointer 6 API calls 17689->17691 17689->17693 17692 b002cf 17690->17692 17691->17693 17692->17677 17694 b002d9 GetProcAddress 17692->17694 17693->17679 17695 af7197 __encode_pointer 6 API calls 17694->17695 17695->17677 17697 af5aec __VEC_memzero 17696->17697 17697->17646 17699 af0d5c IsDebuggerPresent 17698->17699 17700 af0d5a 17698->17700 17706 af718f 17699->17706 17700->17649 17703 af5f49 SetUnhandledExceptionFilter UnhandledExceptionFilter 17704 af5f6e GetCurrentProcess TerminateProcess 17703->17704 17705 af5f66 __invoke_watson 17703->17705 17704->17649 17705->17704 17706->17703 17708 af77b6 ExitProcess 17707->17708 17709 af77a1 GetProcAddress 17707->17709 17709->17708 17710 af77b1 17709->17710 17710->17708 17712 af145b 17711->17712 17718 af13ba 17711->17718 17713 af7167 _realloc 6 API calls 17712->17713 17714 af1461 17713->17714 17717 af47a6 __sopen_helper 61 API calls 17714->17717 17715 af13cb 17716 af7c17 __FF_MSGBANNER 61 API calls 17715->17716 17715->17718 17719 af7a6c __NMSG_WRITE 61 API calls 17715->17719 17722 af77b8 _doexit 3 API calls 17715->17722 17716->17715 17723 af1453 17717->17723 17718->17715 17721 af1417 RtlAllocateHeap 17718->17721 17718->17723 17724 af1447 17718->17724 17725 af7167 _realloc 6 API calls 17718->17725 17727 af144c 17718->17727 17729 af1359 17718->17729 17719->17715 17721->17718 17722->17715 17723->17622 17726 af47a6 __sopen_helper 61 API calls 17724->17726 17725->17718 17726->17727 17728 af47a6 __sopen_helper 61 API calls 17727->17728 17728->17723 17730 af1365 __free_locale 17729->17730 17731 af1396 __free_locale 17730->17731 17732 af6501 __lock 62 API calls 17730->17732 17731->17718 17733 af137b 17732->17733 17734 af6d13 ___sbh_alloc_block 5 API calls 17733->17734 17735 af1386 17734->17735 17737 af139f 17735->17737 17740 af6427 LeaveCriticalSection 17737->17740 17739 af13a6 17739->17731 17740->17739 17741->17628 17743 af688d HeapReAlloc 17742->17743 17744 af68c1 HeapAlloc 17742->17744 17745 af68af 17743->17745 17746 af68ab 17743->17746 17744->17746 17747 af68e4 VirtualAlloc 17744->17747 17745->17744 17746->17513 17747->17746 17748 af68fe HeapFree 17747->17748 17748->17746 17750 af6941 VirtualAlloc 17749->17750 17752 af6988 17750->17752 17752->17515 17753->17519 17754->17452 17773 af6427 LeaveCriticalSection 17755->17773 17757 af7395 17757->17462 17759 af2bec 17758->17759 17760 af2be9 InterlockedIncrement 17758->17760 17761 af2bf9 17759->17761 17762 af2bf6 InterlockedIncrement 17759->17762 17760->17759 17763 af2c06 17761->17763 17764 af2c03 InterlockedIncrement 17761->17764 17762->17761 17765 af2c10 InterlockedIncrement 17763->17765 17767 af2c13 17763->17767 17764->17763 17765->17767 17766 af2c2c InterlockedIncrement 17766->17767 17767->17766 17768 af2c3c InterlockedIncrement 17767->17768 17769 af2c47 InterlockedIncrement 17767->17769 17768->17767 17769->17465 17774 af6427 LeaveCriticalSection 17770->17774 17772 af73e3 17772->17467 17773->17757 17774->17772 17775->17233 17777 b04262 17776->17777 17779 b04269 17776->17779 17777->17779 17783 b04295 17777->17783 17778 af47a6 __sopen_helper 62 API calls 17780 b0426e 17778->17780 17779->17778 17781 af1323 __sopen_helper 6 API calls 17780->17781 17782 b0427d 17781->17782 17782->17259 17783->17782 17784 af47a6 __sopen_helper 62 API calls 17783->17784 17784->17780 17786 b00212 17785->17786 17787 af7197 __encode_pointer 6 API calls 17786->17787 17788 b0022a 17786->17788 17787->17786 17788->17272 17792 af19e0 17789->17792 17791 af1a29 17791->17274 17793 af19ec __free_locale 17792->17793 17800 af77d0 17793->17800 17799 af1a0d __free_locale 17799->17791 17801 af6501 __lock 62 API calls 17800->17801 17802 af19f1 17801->17802 17803 af18f5 17802->17803 17804 af7212 __decode_pointer 6 API calls 17803->17804 17805 af1909 17804->17805 17806 af7212 __decode_pointer 6 API calls 17805->17806 17807 af1919 17806->17807 17808 af199c 17807->17808 17823 af9d02 17807->17823 17820 af1a16 17808->17820 17810 af1983 17811 af7197 __encode_pointer 6 API calls 17810->17811 17812 af1991 17811->17812 17815 af7197 __encode_pointer 6 API calls 17812->17815 17813 af1937 17813->17810 17814 af195b 17813->17814 17836 af4716 17813->17836 17814->17808 17817 af4716 __realloc_crt 72 API calls 17814->17817 17818 af1971 17814->17818 17815->17808 17817->17818 17818->17808 17819 af7197 __encode_pointer 6 API calls 17818->17819 17819->17810 17885 af77d9 17820->17885 17824 af9d0e __free_locale 17823->17824 17825 af9d1e 17824->17825 17828 af9d3b 17824->17828 17826 af47a6 __sopen_helper 62 API calls 17825->17826 17830 af9d23 17826->17830 17827 af9d7c HeapSize 17832 af9d33 __free_locale 17827->17832 17828->17827 17829 af6501 __lock 62 API calls 17828->17829 17833 af9d4b ___sbh_find_block 17829->17833 17831 af1323 __sopen_helper 6 API calls 17830->17831 17831->17832 17832->17813 17841 af9d9c 17833->17841 17839 af471f 17836->17839 17838 af475e 17838->17814 17839->17838 17840 af473f Sleep 17839->17840 17845 affc74 17839->17845 17840->17839 17844 af6427 LeaveCriticalSection 17841->17844 17843 af9d77 17843->17827 17843->17832 17844->17843 17846 affc80 __free_locale 17845->17846 17847 affc87 17846->17847 17848 affc95 17846->17848 17849 af13a8 _malloc 62 API calls 17847->17849 17850 affc9c 17848->17850 17851 affca8 17848->17851 17867 affc8f __free_locale _realloc 17849->17867 17852 af108d __free_locale 62 API calls 17850->17852 17857 affe1a 17851->17857 17873 affcb5 __setlocale_set_cat ___sbh_resize_block ___sbh_find_block 17851->17873 17852->17867 17853 affe4d 17855 af7167 _realloc 6 API calls 17853->17855 17854 affe1f HeapReAlloc 17854->17857 17854->17867 17858 affe53 17855->17858 17856 af6501 __lock 62 API calls 17856->17873 17857->17853 17857->17854 17859 affe71 17857->17859 17861 af7167 _realloc 6 API calls 17857->17861 17863 affe67 17857->17863 17860 af47a6 __sopen_helper 62 API calls 17858->17860 17862 af47a6 __sopen_helper 62 API calls 17859->17862 17859->17867 17860->17867 17861->17857 17864 affe7a GetLastError 17862->17864 17866 af47a6 __sopen_helper 62 API calls 17863->17866 17864->17867 17869 affde8 17866->17869 17867->17839 17868 affd40 HeapAlloc 17868->17873 17869->17867 17871 affded GetLastError 17869->17871 17870 affd95 HeapReAlloc 17870->17873 17871->17867 17872 af6d13 ___sbh_alloc_block 5 API calls 17872->17873 17873->17853 17873->17856 17873->17867 17873->17868 17873->17870 17873->17872 17874 affe00 17873->17874 17875 af7167 _realloc 6 API calls 17873->17875 17877 af6564 __VEC_memcpy VirtualFree VirtualFree HeapFree ___sbh_free_block 17873->17877 17879 affde3 17873->17879 17881 affdb8 17873->17881 17874->17867 17876 af47a6 __sopen_helper 62 API calls 17874->17876 17875->17873 17878 affe0d 17876->17878 17877->17873 17878->17864 17878->17867 17880 af47a6 __sopen_helper 62 API calls 17879->17880 17880->17869 17884 af6427 LeaveCriticalSection 17881->17884 17883 affdbf 17883->17873 17884->17883 17888 af6427 LeaveCriticalSection 17885->17888 17887 af1a1b 17887->17799 17888->17887 17892 af00e1 _memset 17889->17892 17900 af016a 17889->17900 17890 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17891 ae3119 17890->17891 17901 ae4c60 17891->17901 17892->17900 18200 aeff40 17892->18200 17894 af0117 _memset 17895 af0123 lstrlenA 17894->17895 17896 af013e 17895->17896 17897 af0142 __crtGetLocaleInfoA_stat 17895->17897 18229 aeee50 17896->18229 18225 aeec40 17897->18225 17900->17890 17902 ae4cb1 17901->17902 17904 ae4c68 17901->17904 18898 ae4da0 17902->18898 17904->17902 17908 ae4c92 17904->17908 17905 ae4ce1 17905->17280 17906 ae4cbf 17906->17905 18905 af0efb 17906->18905 17909 ae4750 74 API calls 17908->17909 17910 ae4cac 17909->17910 17910->17280 17912 af5ae0 _memset 17911->17912 17913 ae2f61 SHGetValueW 17912->17913 17914 ae304b 17913->17914 17915 ae2fa2 _memset 17913->17915 17916 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17914->17916 17915->17914 17918 ae2fc2 PathCombineW PathFileExistsW 17915->17918 17917 ae305b 17916->17917 17917->17282 17918->17914 17919 ae2fec _memset 17918->17919 19055 ae2e30 17919->19055 17921 ae301e 17921->17914 17922 ae3024 17921->17922 19069 ae3da0 17922->19069 17925 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17926 ae3044 17925->17926 17926->17282 17928 ae4ad7 17927->17928 17929 ae4ad2 17927->17929 17931 ae4afa 17928->17931 17932 aee35d std::_String_base::_Xlen 74 API calls 17928->17932 17930 aee395 std::_String_base::_Xlen 74 API calls 17929->17930 17930->17928 17933 ae31ec 17931->17933 17934 ae4da0 74 API calls 17931->17934 17932->17931 17937 ae4b80 17933->17937 17935 ae4b0a 17934->17935 17935->17933 17936 af0efb _memcpy_s 62 API calls 17935->17936 17936->17933 17938 ae4bd5 17937->17938 17941 ae4b90 17937->17941 17939 ae4bed 17938->17939 17940 aee35d std::_String_base::_Xlen 74 API calls 17938->17940 17942 ae4da0 74 API calls 17939->17942 17948 ae4c26 17939->17948 17940->17939 17941->17938 17943 ae4bba 17941->17943 17944 ae4bfd 17942->17944 17945 ae4ac0 74 API calls 17943->17945 17947 af0efb _memcpy_s 62 API calls 17944->17947 17944->17948 17946 ae4bce 17945->17946 17946->17290 17947->17948 17948->17290 17950 ae4766 17949->17950 17951 ae4761 17949->17951 17953 ae4779 17950->17953 17954 ae4796 17950->17954 17952 aee395 std::_String_base::_Xlen 74 API calls 17951->17952 17952->17950 19090 ae4d10 17953->19090 17956 ae4da0 74 API calls 17954->17956 17960 ae479d 17956->17960 17958 ae4d10 74 API calls 17959 ae478d 17958->17959 17959->17294 17961 af0efb _memcpy_s 62 API calls 17960->17961 17962 ae47d8 17960->17962 17961->17962 17962->17294 17964 ae6d7c 17963->17964 17965 ae6d80 WideCharToMultiByte 17963->17965 17964->17965 17966 ae6d9c 17965->17966 17977 ae6e44 17965->17977 17968 ae6dae 17966->17968 17969 ae6e00 WideCharToMultiByte 17966->17969 17967 ae4570 std::_String_base::_Xlen 74 API calls 17974 ae6dcb ctype 17967->17974 17971 ae4570 std::_String_base::_Xlen 74 API calls 17968->17971 17972 ae6e30 17969->17972 17971->17974 17972->17972 19096 ae9040 17972->19096 17973 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 17975 ae3233 17973->17975 17974->17973 17978 ae70a0 17975->17978 17977->17967 19122 ae85e0 17978->19122 17982 ae7108 19137 ae8770 17982->19137 17985 ae71b0 17986 ae71c2 __write_nolock 17985->17986 17987 ae4570 std::_String_base::_Xlen 74 API calls 17986->17987 17988 ae7221 17987->17988 19155 ae6b60 17988->19155 17991 ae723c 17993 ae724f 17991->17993 17994 ae80e0 InternetCloseHandle 17991->17994 17995 ae7261 17993->17995 17996 ae80e0 InternetCloseHandle 17993->17996 17994->17993 17997 ae4c60 74 API calls 17995->17997 17996->17995 17998 ae728b 17997->17998 19169 ae6ec0 17998->19169 18003 ae72da 19185 ae7890 18003->19185 18004 af0d72 std::exception::exception 62 API calls 18005 ae72c9 18004->18005 18007 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18005->18007 18007->18003 18009 ae731f 19189 ae7940 18009->19189 18010 af0d72 std::exception::exception 62 API calls 18011 ae7311 18010->18011 18014 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18011->18014 18014->18009 18015 ae7367 19193 ae79f0 lstrlenW HttpAddRequestHeadersW 18015->19193 18016 af0d72 std::exception::exception 62 API calls 18017 ae7356 18016->18017 18019 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18017->18019 18019->18015 18021 ae73a3 19195 ae7a70 HttpSendRequestW 18021->19195 18022 af0d72 std::exception::exception 62 API calls 18025 ae7395 18022->18025 18027 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18025->18027 18026 ae73b3 GetLastError 19197 ae87c0 18026->19197 18027->18021 18030 ae745c 19233 ae7be0 18030->19233 18031 ae742c 18031->18030 18033 af0d72 std::exception::exception 62 API calls 18031->18033 18036 ae744b 18033->18036 18039 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18036->18039 18039->18030 18041 ae4570 std::_String_base::_Xlen 74 API calls 18049 ae74a0 18041->18049 18044 ae771f 18045 af0d72 std::exception::exception 62 API calls 18044->18045 18047 ae7735 18045->18047 18050 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18047->18050 18049->18044 18052 ae7be0 78 API calls 18049->18052 18053 ae7746 18050->18053 18054 ae74e7 18052->18054 19326 ae4650 18053->19326 18055 ae4570 std::_String_base::_Xlen 74 API calls 18054->18055 18056 ae74fe 18055->18056 18059 ae76f8 18056->18059 18060 ae7516 18056->18060 18061 af0d72 std::exception::exception 62 API calls 18059->18061 18062 ae4570 std::_String_base::_Xlen 74 API calls 18060->18062 18063 ae770e 18061->18063 18064 ae7529 18062->18064 18065 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18063->18065 18066 ae3bd0 std::_String_base::_Xlen 74 API calls 18064->18066 18065->18044 18067 ae7536 18066->18067 19252 ae7d80 18067->19252 18069 ae7549 18070 ae7566 __setlocale_set_cat 18069->18070 18071 ae85e0 74 API calls 18070->18071 18073 ae75bd 18070->18073 18077 af1349 6 API calls 18070->18077 18078 ae86f0 6 API calls 18070->18078 19281 ae8060 InternetReadFile 18070->19281 19290 af1d4a 18070->19290 19307 ae9470 18070->19307 19319 ae86d0 18070->19319 19323 aeb8f0 18070->19323 18071->18070 19283 ae8710 18073->19283 18077->18070 18078->18070 18079 ae75d8 18081 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18079->18081 18083 ae762f 18081->18083 18083->17300 18085 af1323 __sopen_helper 6 API calls 18084->18085 18086 af1355 18085->18086 18086->17304 18088 ae3bf0 18087->18088 18089 ae4950 std::_String_base::_Xlen 74 API calls 18088->18089 18090 ae3295 18089->18090 18091 aec4b0 18090->18091 19787 aec190 18091->19787 18203 aeff4a __write_nolock 18200->18203 18201 af00a9 18202 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18201->18202 18204 af00b9 18202->18204 18203->18201 18233 aefcc0 18203->18233 18204->17894 18206 aeff7f 18206->18201 18207 aeff8a _memset 18206->18207 18245 aefbf0 18207->18245 18211 aeffb5 18213 aeffee 18211->18213 18266 aef290 18211->18266 18302 aef850 18213->18302 18217 aeffdb 18217->18213 18289 aef5d0 18217->18289 18218 af001c 18222 af002f 18218->18222 18323 aefa70 18218->18323 18338 aeeec0 18222->18338 18226 aeec49 18225->18226 18227 aeec75 18225->18227 18226->18227 18228 aeec51 MultiByteToWideChar 18226->18228 18227->17896 18228->17896 18230 aeee5d 18229->18230 18232 aeee8b 18230->18232 18857 af5766 18230->18857 18232->17900 18234 aefe3d 18233->18234 18235 aefce4 _memset 18233->18235 18236 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18234->18236 18235->18234 18238 aefd11 SHGetValueA 18235->18238 18237 aefe4e 18236->18237 18237->18206 18238->18234 18239 aefd43 _memset 18238->18239 18239->18234 18240 aeeec0 123 API calls 18239->18240 18241 aefdfc lstrcmpiA 18240->18241 18241->18234 18242 aefe16 18241->18242 18243 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18242->18243 18244 aefe36 18243->18244 18244->18206 18246 aefc73 18245->18246 18250 aefc98 18246->18250 18357 aeedf0 18246->18357 18248 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18249 aefcba 18248->18249 18251 aef080 18249->18251 18250->18248 18252 aef276 18251->18252 18253 aef0a7 18251->18253 18254 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18252->18254 18253->18252 18265 aef0b5 _memset 18253->18265 18255 aef286 18254->18255 18255->18211 18256 aeedf0 98 API calls 18257 aef0e8 CreateFileA 18256->18257 18258 aef10f DeviceIoControl 18257->18258 18257->18265 18259 aef152 CloseHandle 18258->18259 18258->18265 18259->18265 18260 aef25a 18262 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18260->18262 18261 aef242 CloseHandle 18261->18260 18261->18265 18263 aef26f 18262->18263 18263->18211 18265->18256 18265->18260 18265->18261 18265->18265 18630 af0ce0 DeviceIoControl 18265->18630 18274 aef2d0 _memset _strncpy 18266->18274 18267 aeedf0 98 API calls 18268 aef2e8 CreateFileA 18267->18268 18268->18274 18269 aef423 18270 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18269->18270 18271 aef439 18270->18271 18271->18213 18275 aef440 18271->18275 18272 aef370 DeviceIoControl 18272->18274 18273 aef40a CloseHandle 18273->18274 18274->18267 18274->18269 18274->18272 18274->18273 18276 aef44a __write_nolock 18275->18276 18277 aef5ab 18276->18277 18288 aef47b _memset 18276->18288 18278 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18277->18278 18279 aef5bc 18278->18279 18279->18217 18280 aeedf0 98 API calls 18281 aef4a5 CreateFileA 18280->18281 18281->18288 18282 aef58e 18283 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18282->18283 18285 aef5a4 18283->18285 18284 aef4ef DeviceIoControl 18286 aef577 CloseHandle 18284->18286 18284->18288 18285->18217 18286->18282 18286->18288 18288->18280 18288->18282 18288->18284 18288->18286 18631 af0b60 18288->18631 18294 aef600 18289->18294 18290 aeedf0 98 API calls 18291 aef618 CreateFileA 18290->18291 18292 aef643 DeviceIoControl 18291->18292 18291->18294 18292->18294 18293 aef722 18295 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18293->18295 18294->18290 18294->18293 18296 af13a8 _malloc 62 API calls 18294->18296 18297 aef738 18295->18297 18298 aef690 DeviceIoControl 18296->18298 18297->18213 18299 aef701 CloseHandle 18298->18299 18301 aef6bd 18298->18301 18300 af108d __free_locale 62 API calls 18299->18300 18300->18294 18301->18299 18303 aef878 _memset 18302->18303 18304 aefa51 18302->18304 18303->18304 18307 aef894 RegOpenKeyExA 18303->18307 18305 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18304->18305 18306 aefa62 18305->18306 18306->18218 18308 aefa18 18307->18308 18309 aef8b8 RegEnumKeyExA 18307->18309 18308->18304 18310 aefa1f 18308->18310 18311 aef8ea 18309->18311 18312 aefa0b RegCloseKey 18309->18312 18316 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18310->18316 18313 aef8f0 RegOpenKeyExA 18311->18313 18312->18308 18314 aef9d9 RegEnumKeyExA 18313->18314 18315 aef914 RegQueryValueExA 18313->18315 18314->18313 18318 aefa07 18314->18318 18317 aef9ce RegCloseKey 18315->18317 18322 aef94c _memset 18315->18322 18319 aefa4a 18316->18319 18317->18314 18318->18312 18319->18218 18321 aef980 lstrcmpA 18321->18317 18321->18322 18322->18317 18322->18321 18798 aef740 18322->18798 18324 af5ae0 _memset 18323->18324 18325 aefa9a Netbios 18324->18325 18326 aefbca 18325->18326 18327 aefac6 _memset 18325->18327 18328 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18326->18328 18329 aefadb Netbios 18327->18329 18330 aefbdb 18328->18330 18331 aefaff _memset 18329->18331 18330->18222 18332 aefb40 Netbios 18331->18332 18332->18326 18333 aefb65 18332->18333 18334 aeedf0 98 API calls 18333->18334 18335 aefba8 18334->18335 18336 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18335->18336 18337 aefbc3 18336->18337 18337->18222 18339 aeeefa _memset 18338->18339 18340 aeedf0 98 API calls 18339->18340 18342 aeef1e _memset _strncat 18340->18342 18341 aeedf0 98 API calls 18341->18342 18342->18341 18343 aef031 _memset 18342->18343 18346 aeedf0 98 API calls 18343->18346 18349 aef05c 18343->18349 18344 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18345 aef06f 18344->18345 18345->18201 18350 aefe60 18345->18350 18347 aef056 18346->18347 18811 af593a 18347->18811 18349->18344 18351 aefe89 _memset 18350->18351 18352 aeeec0 123 API calls 18351->18352 18353 aefe99 18352->18353 18354 aefefd SHSetValueA 18353->18354 18355 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18354->18355 18356 aeff2d 18355->18356 18356->18201 18358 aeedfa 18357->18358 18360 aeee28 18358->18360 18361 af5675 18358->18361 18360->18250 18364 af55c2 18361->18364 18365 af55f2 18364->18365 18366 af55d2 18364->18366 18367 af561e 18365->18367 18370 af5601 18365->18370 18368 af47a6 __sopen_helper 62 API calls 18366->18368 18379 af7db4 18367->18379 18369 af55d7 18368->18369 18371 af1323 __sopen_helper 6 API calls 18369->18371 18372 af47a6 __sopen_helper 62 API calls 18370->18372 18374 af55e7 18371->18374 18375 af5606 18372->18375 18374->18360 18376 af1323 __sopen_helper 6 API calls 18375->18376 18376->18374 18420 af1b27 18379->18420 18382 af7e1f 18383 af47a6 __sopen_helper 62 API calls 18382->18383 18384 af7e24 18383->18384 18386 af1323 __sopen_helper 6 API calls 18384->18386 18387 af7e36 18386->18387 18388 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18387->18388 18389 af564d 18388->18389 18389->18374 18399 af7c50 18389->18399 18391 b007c4 96 API calls _write_string 18395 af7e60 __aulldvrm __woutput_l _strlen 18391->18395 18392 af108d __free_locale 62 API calls 18392->18395 18393 b007f7 96 API calls _write_multi_char 18393->18395 18394 b007a7 74 API calls __cftof 18394->18395 18395->18382 18395->18387 18395->18391 18395->18392 18395->18393 18395->18394 18396 af4685 __malloc_crt 62 API calls 18395->18396 18397 af7212 6 API calls __decode_pointer 18395->18397 18398 b0081d 96 API calls _write_string 18395->18398 18434 afb322 18395->18434 18396->18395 18397->18395 18398->18395 18400 af8c09 __fileno 62 API calls 18399->18400 18401 af7c60 18400->18401 18402 af7c6b 18401->18402 18403 af7c82 18401->18403 18405 af47a6 __sopen_helper 62 API calls 18402->18405 18404 af7c86 18403->18404 18414 af7c93 __flsbuf 18403->18414 18406 af47a6 __sopen_helper 62 API calls 18404->18406 18413 af7c70 18405->18413 18406->18413 18407 af7cf4 18408 af7d83 18407->18408 18409 af7d03 18407->18409 18410 af9c26 __locking 96 API calls 18408->18410 18411 af7d1a 18409->18411 18417 af7d37 18409->18417 18410->18413 18485 af9c26 18411->18485 18413->18374 18414->18407 18414->18413 18416 af7ce9 18414->18416 18473 b005d7 18414->18473 18416->18407 18482 b0058e 18416->18482 18417->18413 18510 b00475 18417->18510 18421 af1b3a 18420->18421 18425 af1b87 18420->18425 18437 af745e 18421->18437 18423 af1b67 18423->18425 18457 afae65 18423->18457 18425->18382 18425->18395 18428 af8c09 18425->18428 18429 af8c18 18428->18429 18433 af8c2d 18428->18433 18430 af47a6 __sopen_helper 62 API calls 18429->18430 18431 af8c1d 18430->18431 18432 af1323 __sopen_helper 6 API calls 18431->18432 18432->18433 18433->18395 18435 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18434->18435 18436 afb335 18435->18436 18436->18395 18438 af73e5 __getptd_noexit 62 API calls 18437->18438 18439 af7466 18438->18439 18440 af1b3f 18439->18440 18441 af7764 __amsg_exit 62 API calls 18439->18441 18440->18423 18442 af2d57 18440->18442 18441->18440 18443 af2d63 __free_locale 18442->18443 18444 af745e __getptd 62 API calls 18443->18444 18445 af2d68 18444->18445 18446 af2d96 18445->18446 18448 af2d7a 18445->18448 18447 af6501 __lock 62 API calls 18446->18447 18449 af2d9d 18447->18449 18450 af745e __getptd 62 API calls 18448->18450 18451 af2d19 _setlocale 70 API calls 18449->18451 18453 af2d7f 18450->18453 18452 af2db0 18451->18452 18455 af2dc1 ___pctype_func LeaveCriticalSection 18452->18455 18454 af2d8d __free_locale 18453->18454 18456 af7764 __amsg_exit 62 API calls 18453->18456 18454->18423 18455->18453 18456->18454 18458 afae71 __free_locale 18457->18458 18459 af745e __getptd 62 API calls 18458->18459 18460 afae76 18459->18460 18461 af6501 __lock 62 API calls 18460->18461 18470 afae88 18460->18470 18462 afaea6 18461->18462 18463 afaeef 18462->18463 18464 afaebd InterlockedDecrement 18462->18464 18465 afaed7 InterlockedIncrement 18462->18465 18467 afaf00 _LocaleUpdate::_LocaleUpdate LeaveCriticalSection 18463->18467 18464->18465 18469 afaec8 18464->18469 18465->18463 18466 af7764 __amsg_exit 62 API calls 18468 afae96 __free_locale 18466->18468 18467->18470 18468->18425 18469->18465 18471 af108d __free_locale 62 API calls 18469->18471 18470->18466 18470->18468 18472 afaed6 18471->18472 18472->18465 18474 b005e4 18473->18474 18475 b005f3 18473->18475 18476 af47a6 __sopen_helper 62 API calls 18474->18476 18478 b00617 18475->18478 18479 af47a6 __sopen_helper 62 API calls 18475->18479 18477 b005e9 18476->18477 18477->18416 18478->18416 18480 b00607 18479->18480 18481 af1323 __sopen_helper 6 API calls 18480->18481 18481->18478 18483 af4685 __malloc_crt 62 API calls 18482->18483 18484 b005a3 18483->18484 18484->18407 18486 af9c32 __free_locale 18485->18486 18487 af9c3a 18486->18487 18489 af9c55 18486->18489 18542 af47b9 18487->18542 18490 af9c63 18489->18490 18493 af9ca4 18489->18493 18492 af47b9 __read_nolock 62 API calls 18490->18492 18495 af9c68 18492->18495 18545 b015b8 18493->18545 18494 af47a6 __sopen_helper 62 API calls 18503 af9c47 __free_locale 18494->18503 18497 af47a6 __sopen_helper 62 API calls 18495->18497 18499 af9c6f 18497->18499 18498 af9caa 18500 af9ccd 18498->18500 18501 af9cb7 18498->18501 18502 af1323 __sopen_helper 6 API calls 18499->18502 18505 af47a6 __sopen_helper 62 API calls 18500->18505 18555 af94f3 18501->18555 18502->18503 18503->18413 18507 af9cd2 18505->18507 18506 af9cc5 18614 af9cf8 18506->18614 18508 af47b9 __read_nolock 62 API calls 18507->18508 18508->18506 18511 b00481 __free_locale 18510->18511 18512 b00492 18511->18512 18513 b004ae 18511->18513 18514 af47b9 __read_nolock 62 API calls 18512->18514 18515 b004bc 18513->18515 18517 b004dd 18513->18517 18516 b00497 18514->18516 18518 af47b9 __read_nolock 62 API calls 18515->18518 18521 af47a6 __sopen_helper 62 API calls 18516->18521 18519 b00523 18517->18519 18520 b004fd 18517->18520 18522 b004c1 18518->18522 18524 b015b8 ___lock_fhandle 63 API calls 18519->18524 18523 af47b9 __read_nolock 62 API calls 18520->18523 18534 b0049f __free_locale 18521->18534 18525 af47a6 __sopen_helper 62 API calls 18522->18525 18526 b00502 18523->18526 18527 b00529 18524->18527 18528 b004c8 18525->18528 18529 af47a6 __sopen_helper 62 API calls 18526->18529 18530 b00552 18527->18530 18531 b00536 18527->18531 18532 af1323 __sopen_helper 6 API calls 18528->18532 18533 b00509 18529->18533 18536 af47a6 __sopen_helper 62 API calls 18530->18536 18617 b003f0 18531->18617 18532->18534 18538 af1323 __sopen_helper 6 API calls 18533->18538 18534->18413 18537 b00557 18536->18537 18540 af47b9 __read_nolock 62 API calls 18537->18540 18538->18534 18539 b00547 18627 b00584 18539->18627 18540->18539 18543 af73e5 __getptd_noexit 62 API calls 18542->18543 18544 af47be 18543->18544 18544->18494 18546 b015c4 __free_locale 18545->18546 18547 b0161f 18546->18547 18550 af6501 __lock 62 API calls 18546->18550 18548 b01641 __free_locale 18547->18548 18549 b01624 EnterCriticalSection 18547->18549 18548->18498 18549->18548 18551 b015f0 18550->18551 18552 b01607 18551->18552 18554 b001ac __mtinitlocknum InitializeCriticalSectionAndSpinCount 18551->18554 18553 b0164f ___lock_fhandle LeaveCriticalSection 18552->18553 18553->18547 18554->18552 18556 af9502 __write_nolock 18555->18556 18557 af9529 18556->18557 18558 af955b 18556->18558 18559 af9534 18556->18559 18560 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18557->18560 18562 af95c3 18558->18562 18563 af959d 18558->18563 18561 af47b9 __read_nolock 62 API calls 18559->18561 18564 af9c24 18560->18564 18565 af9539 18561->18565 18567 af95d7 18562->18567 18570 b003f0 __lseeki64_nolock 64 API calls 18562->18570 18566 af47b9 __read_nolock 62 API calls 18563->18566 18564->18506 18568 af47a6 __sopen_helper 62 API calls 18565->18568 18569 af95a2 18566->18569 18572 b005d7 __write_nolock 62 API calls 18567->18572 18571 af9540 18568->18571 18573 af47a6 __sopen_helper 62 API calls 18569->18573 18570->18567 18574 af1323 __sopen_helper 6 API calls 18571->18574 18575 af95e2 18572->18575 18577 af95ab 18573->18577 18574->18557 18576 af9888 18575->18576 18581 af745e __getptd 62 API calls 18575->18581 18579 af9898 18576->18579 18580 af9b57 WriteFile 18576->18580 18578 af1323 __sopen_helper 6 API calls 18577->18578 18578->18557 18582 af9976 18579->18582 18599 af98ac 18579->18599 18584 af9b8a GetLastError 18580->18584 18587 af986a 18580->18587 18583 af95fd GetConsoleMode 18581->18583 18603 af9a56 18582->18603 18606 af9985 18582->18606 18583->18576 18586 af9628 18583->18586 18584->18587 18585 af9bd5 18585->18557 18589 af47a6 __sopen_helper 62 API calls 18585->18589 18586->18576 18588 af963a GetConsoleCP 18586->18588 18587->18557 18587->18585 18590 af9ba8 18587->18590 18588->18587 18608 af965d 18588->18608 18592 af9bf8 18589->18592 18594 af9bc7 18590->18594 18595 af9bb3 18590->18595 18591 af991a WriteFile 18591->18584 18591->18599 18600 af47b9 __read_nolock 62 API calls 18592->18600 18593 af9abc WideCharToMultiByte 18593->18584 18596 af9af3 WriteFile 18593->18596 18598 af47cc __dosmaperr 62 API calls 18594->18598 18601 af47a6 __sopen_helper 62 API calls 18595->18601 18596->18603 18604 af9b2a GetLastError 18596->18604 18597 af99fa WriteFile 18597->18584 18597->18606 18598->18557 18599->18585 18599->18587 18599->18591 18600->18557 18602 af9bb8 18601->18602 18605 af47b9 __read_nolock 62 API calls 18602->18605 18603->18585 18603->18587 18603->18593 18603->18596 18604->18603 18605->18557 18606->18585 18606->18587 18606->18597 18607 afb35a __write_nolock 72 API calls 18607->18608 18608->18584 18608->18587 18608->18607 18609 af9709 WideCharToMultiByte 18608->18609 18610 b0267f 74 API calls __fassign 18608->18610 18612 b024a3 11 API calls __putwch_nolock 18608->18612 18613 af978e WriteFile 18608->18613 18609->18587 18611 af973a WriteFile 18609->18611 18610->18608 18611->18584 18611->18608 18612->18608 18613->18584 18613->18608 18615 b01658 __unlock_fhandle LeaveCriticalSection 18614->18615 18616 af9d00 18615->18616 18616->18503 18618 b01541 __chsize_nolock 62 API calls 18617->18618 18619 b0040e 18618->18619 18620 b00416 18619->18620 18621 b00427 SetFilePointer 18619->18621 18623 af47a6 __sopen_helper 62 API calls 18620->18623 18622 b0043f GetLastError 18621->18622 18625 b0041b 18621->18625 18624 b00449 18622->18624 18622->18625 18623->18625 18626 af47cc __dosmaperr 62 API calls 18624->18626 18625->18539 18626->18625 18628 b01658 __unlock_fhandle LeaveCriticalSection 18627->18628 18629 b0058c 18628->18629 18629->18534 18630->18265 18632 af0c33 18631->18632 18635 af0b74 18631->18635 18632->18288 18635->18632 18636 af0c0f 18635->18636 18639 af1cc3 18635->18639 18643 af2024 18635->18643 18648 af20a8 18635->18648 18636->18632 18637 af20a8 86 API calls 18636->18637 18637->18636 18640 af1ce1 18639->18640 18642 af1cd1 18639->18642 18653 af1bae 18640->18653 18642->18635 18644 af2044 18643->18644 18645 af2032 18643->18645 18788 af1fd3 18644->18788 18645->18635 18649 af20ca 18648->18649 18650 af20b6 18648->18650 18793 af2052 18649->18793 18650->18635 18654 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18653->18654 18655 af1bc3 18654->18655 18656 af1bcf 18655->18656 18657 af1c23 18655->18657 18659 af1be7 18656->18659 18665 afb36d 18656->18665 18658 af1c48 18657->18658 18660 afb322 __isleadbyte_l 72 API calls 18657->18660 18661 af47a6 __sopen_helper 62 API calls 18658->18661 18663 af1c4e 18658->18663 18659->18642 18660->18658 18661->18663 18672 af3eb8 18663->18672 18666 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18665->18666 18667 afb381 18666->18667 18668 afb38e 18667->18668 18669 afb322 __isleadbyte_l 72 API calls 18667->18669 18668->18659 18670 afb3b6 18669->18670 18677 aff6ac 18670->18677 18673 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18672->18673 18674 af3ecb 18673->18674 18706 af3b13 18674->18706 18678 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18677->18678 18679 aff6bf 18678->18679 18682 aff4f2 18679->18682 18683 aff53e 18682->18683 18684 aff513 GetStringTypeW 18682->18684 18685 aff52b 18683->18685 18687 aff625 18683->18687 18684->18685 18686 aff533 GetLastError 18684->18686 18688 aff577 MultiByteToWideChar 18685->18688 18698 aff61f 18685->18698 18686->18683 18689 aff730 ___ansicp 80 API calls 18687->18689 18693 aff5a4 18688->18693 18688->18698 18692 aff649 18689->18692 18690 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18691 aff6aa 18690->18691 18691->18668 18694 aff676 GetStringTypeA 18692->18694 18697 aff779 ___convertcp 69 API calls 18692->18697 18692->18698 18695 af13a8 _malloc 62 API calls 18693->18695 18701 aff5b9 _memset __crtGetLocaleInfoA_stat 18693->18701 18694->18698 18699 aff691 18694->18699 18695->18701 18696 aff5f2 MultiByteToWideChar 18702 aff619 18696->18702 18703 aff608 GetStringTypeW 18696->18703 18704 aff66a 18697->18704 18698->18690 18700 af108d __free_locale 62 API calls 18699->18700 18700->18698 18701->18696 18701->18698 18705 af3af3 __freea 62 API calls 18702->18705 18703->18702 18704->18694 18704->18698 18705->18698 18707 af3b34 LCMapStringW 18706->18707 18710 af3b4f 18706->18710 18708 af3b57 GetLastError 18707->18708 18707->18710 18708->18710 18709 af3d4d 18757 aff730 GetLocaleInfoA 18709->18757 18710->18709 18711 af3ba9 18710->18711 18713 af3bc2 MultiByteToWideChar 18711->18713 18736 af3d44 18711->18736 18719 af3bef 18713->18719 18713->18736 18715 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18716 af3eb6 18715->18716 18716->18659 18717 af3d8e 18763 aff779 18717->18763 18718 af3e69 LCMapStringA 18752 af3dc5 18718->18752 18723 af13a8 _malloc 62 API calls 18719->18723 18731 af3c08 __crtGetLocaleInfoA_stat 18719->18731 18721 af3c40 MultiByteToWideChar 18725 af3c59 LCMapStringW 18721->18725 18747 af3d3b 18721->18747 18722 af3e90 18733 af108d __free_locale 62 API calls 18722->18733 18722->18736 18723->18731 18726 af3c7a 18725->18726 18725->18747 18730 af3c83 18726->18730 18738 af3cac 18726->18738 18727 af108d __free_locale 62 API calls 18727->18722 18728 af3daa LCMapStringA 18739 af3dcc 18728->18739 18728->18752 18729 af3af3 __freea 62 API calls 18729->18736 18735 af3c95 LCMapStringW 18730->18735 18730->18747 18731->18721 18731->18736 18732 af3cc7 __crtGetLocaleInfoA_stat 18737 af3cfb LCMapStringW 18732->18737 18732->18747 18733->18736 18734 af3ddd _memset __crtGetLocaleInfoA_stat 18745 af3e1b LCMapStringA 18734->18745 18734->18752 18735->18747 18736->18715 18740 af3d35 18737->18740 18743 af3d13 WideCharToMultiByte 18737->18743 18738->18732 18742 af13a8 _malloc 62 API calls 18738->18742 18739->18734 18741 af13a8 _malloc 62 API calls 18739->18741 18753 af3af3 18740->18753 18741->18734 18742->18732 18743->18740 18748 af3e3b 18745->18748 18749 af3e37 18745->18749 18747->18729 18750 aff779 ___convertcp 69 API calls 18748->18750 18751 af3af3 __freea 62 API calls 18749->18751 18750->18749 18751->18752 18752->18722 18752->18727 18754 af3aff 18753->18754 18756 af3b10 18753->18756 18755 af108d __free_locale 62 API calls 18754->18755 18754->18756 18755->18756 18756->18747 18758 aff75e 18757->18758 18759 aff763 18757->18759 18761 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18758->18761 18760 af1b06 ___ansicp 85 API calls 18759->18760 18760->18758 18762 af3d75 18761->18762 18762->18717 18762->18718 18762->18736 18764 aff7b9 GetCPInfo 18763->18764 18765 aff843 18763->18765 18766 aff82e MultiByteToWideChar 18764->18766 18767 aff7d0 18764->18767 18768 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18765->18768 18766->18765 18772 aff7e9 _strlen 18766->18772 18767->18766 18769 aff7d6 GetCPInfo 18767->18769 18770 af3da0 18768->18770 18769->18766 18771 aff7e3 18769->18771 18770->18728 18770->18736 18771->18766 18771->18772 18773 af13a8 _malloc 62 API calls 18772->18773 18776 aff81b _memset __crtGetLocaleInfoA_stat 18772->18776 18773->18776 18774 aff878 MultiByteToWideChar 18775 aff890 18774->18775 18786 aff8af 18774->18786 18778 aff897 WideCharToMultiByte 18775->18778 18779 aff8b4 18775->18779 18776->18765 18776->18774 18777 af3af3 __freea 62 API calls 18777->18765 18778->18786 18780 aff8bf WideCharToMultiByte 18779->18780 18781 aff8d3 18779->18781 18780->18781 18780->18786 18782 af46ca __calloc_crt 62 API calls 18781->18782 18783 aff8db 18782->18783 18784 aff8e4 WideCharToMultiByte 18783->18784 18783->18786 18785 aff8f6 18784->18785 18784->18786 18787 af108d __free_locale 62 API calls 18785->18787 18786->18777 18787->18786 18789 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18788->18789 18790 af1fe6 18789->18790 18791 af2000 18790->18791 18792 afb36d __isctype_l 86 API calls 18790->18792 18791->18635 18792->18791 18794 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18793->18794 18795 af2065 18794->18795 18796 afb36d __isctype_l 86 API calls 18795->18796 18797 af2082 18795->18797 18796->18797 18797->18635 18799 aeedf0 98 API calls 18798->18799 18800 aef775 CreateFileA 18799->18800 18801 aef79b 18800->18801 18802 aef7b4 DeviceIoControl 18800->18802 18805 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18801->18805 18803 aef82c CloseHandle 18802->18803 18804 aef7e7 18802->18804 18806 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18803->18806 18804->18803 18808 aeedf0 98 API calls 18804->18808 18807 aef7ad 18805->18807 18809 aef845 18806->18809 18807->18322 18810 aef824 18808->18810 18809->18322 18810->18803 18812 af598b 18811->18812 18813 af594a 18811->18813 18819 af5906 18812->18819 18815 af47a6 __sopen_helper 62 API calls 18813->18815 18818 af5966 18813->18818 18816 af5956 18815->18816 18817 af1323 __sopen_helper 6 API calls 18816->18817 18817->18818 18818->18349 18820 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18819->18820 18821 af5919 18820->18821 18824 af5783 18821->18824 18825 af57bd _strnlen 18824->18825 18826 af57a1 18824->18826 18825->18826 18829 af57d1 18825->18829 18827 af47a6 __sopen_helper 62 API calls 18826->18827 18828 af57a6 18827->18828 18830 af1323 __sopen_helper 6 API calls 18828->18830 18831 af3eb8 ___crtLCMapStringA 97 API calls 18829->18831 18836 af57b5 18829->18836 18830->18836 18832 af5814 18831->18832 18833 af5837 18832->18833 18834 af5820 18832->18834 18839 af583c 18833->18839 18842 af584a 18833->18842 18838 af47a6 __sopen_helper 62 API calls 18834->18838 18835 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18837 af5904 18835->18837 18836->18835 18837->18818 18840 af5825 18838->18840 18841 af47a6 __sopen_helper 62 API calls 18839->18841 18843 af47a6 __sopen_helper 62 API calls 18840->18843 18841->18828 18847 af13a8 _malloc 62 API calls 18842->18847 18852 af5864 __crtGetLocaleInfoA_stat 18842->18852 18843->18836 18844 af589b 18848 af47a6 __sopen_helper 62 API calls 18844->18848 18845 af58a8 18846 af3eb8 ___crtLCMapStringA 97 API calls 18845->18846 18849 af58c3 18846->18849 18847->18852 18848->18840 18850 af58dd 18849->18850 18851 af58ca 18849->18851 18854 af47a6 __sopen_helper 62 API calls 18850->18854 18853 af5f82 _strcpy_s 62 API calls 18851->18853 18852->18844 18852->18845 18855 af58d6 18853->18855 18854->18855 18856 af3af3 __freea 62 API calls 18855->18856 18856->18836 18860 af5692 18857->18860 18861 af56c2 18860->18861 18862 af56a2 18860->18862 18863 af56ee 18861->18863 18865 af56d1 18861->18865 18864 af47a6 __sopen_helper 62 API calls 18862->18864 18877 af9e4d 18863->18877 18866 af56a7 18864->18866 18868 af47a6 __sopen_helper 62 API calls 18865->18868 18867 af1323 __sopen_helper 6 API calls 18866->18867 18875 af56b7 18867->18875 18869 af56d6 18868->18869 18871 af1323 __sopen_helper 6 API calls 18869->18871 18871->18875 18873 af5731 18873->18875 18876 af7c50 __flsbuf 96 API calls 18873->18876 18874 af7c50 __flsbuf 96 API calls 18874->18873 18875->18232 18876->18875 18878 af1b27 _LocaleUpdate::_LocaleUpdate 72 API calls 18877->18878 18879 af9eb4 18878->18879 18880 af9ebc 18879->18880 18889 af9ef3 __aulldvrm __woutput_l _strlen 18879->18889 18881 af47a6 __sopen_helper 62 API calls 18880->18881 18893 af9ec1 18881->18893 18882 af1323 __sopen_helper 6 API calls 18884 af9ed1 18882->18884 18883 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 18885 af5723 18883->18885 18884->18883 18885->18873 18885->18874 18885->18875 18886 af108d __free_locale 62 API calls 18886->18889 18887 afb322 __isleadbyte_l 72 API calls 18887->18889 18888 afa983 18891 af47a6 __sopen_helper 62 API calls 18888->18891 18889->18884 18889->18886 18889->18887 18889->18888 18890 af4685 __malloc_crt 62 API calls 18889->18890 18892 af9dfb 98 API calls _write_string 18889->18892 18894 b02568 74 API calls __fassign 18889->18894 18895 af7212 6 API calls __decode_pointer 18889->18895 18896 af9da5 98 API calls __woutput_l 18889->18896 18897 af9dd4 98 API calls _write_multi_char 18889->18897 18890->18889 18891->18893 18892->18889 18893->18882 18894->18889 18895->18889 18896->18889 18897->18889 18899 ae4dab 18898->18899 18900 ae4db0 18898->18900 18928 aee35d 18899->18928 18902 ae4dcc 18900->18902 18914 ae5280 18900->18914 18902->17906 18904 ae4dc2 18904->17906 18908 af0f0f _memset 18905->18908 18910 af0f0b __setlocale_set_cat 18905->18910 18906 af0f14 18907 af47a6 __sopen_helper 62 API calls 18906->18907 18909 af0f19 18907->18909 18908->18906 18908->18910 18911 af0f5e 18908->18911 18912 af1323 __sopen_helper 6 API calls 18909->18912 18910->17905 18911->18910 18913 af47a6 __sopen_helper 62 API calls 18911->18913 18912->18910 18913->18909 18915 ae52be 18914->18915 18916 ae52f0 18915->18916 18917 ae530e 18915->18917 18936 af1187 18916->18936 18948 af0d72 18917->18948 18922 ae5332 18957 ae5930 18922->18957 18923 ae537d ctype 18923->18904 18925 ae52fb 18925->18923 18927 af0efb _memcpy_s 62 API calls 18925->18927 18927->18923 18929 aee369 __EH_prolog3 18928->18929 18930 ae3bd0 std::_String_base::_Xlen 74 API calls 18929->18930 18931 aee376 18930->18931 18976 ae1130 18931->18976 18934 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18935 aee394 18934->18935 18939 af1191 18936->18939 18937 af13a8 _malloc 62 API calls 18937->18939 18938 af11ab 18938->18925 18939->18937 18939->18938 18940 af7167 _realloc 6 API calls 18939->18940 18942 af11ad std::bad_alloc::bad_alloc 18939->18942 18940->18939 18944 af1a1c __cinit 73 API calls 18942->18944 18946 af11d3 18942->18946 18944->18946 18945 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18947 af11eb 18945->18947 18967 ae2e10 18946->18967 18949 af0d8b _strlen 18948->18949 18950 ae531d 18948->18950 18951 af13a8 _malloc 62 API calls 18949->18951 18954 af249b 18950->18954 18952 af0d9a 18951->18952 18952->18950 18953 af5f82 _strcpy_s 62 API calls 18952->18953 18953->18950 18955 af24c4 18954->18955 18956 af24d0 KiUserExceptionDispatcher 18954->18956 18955->18956 18956->18922 18958 ae5949 18957->18958 18959 ae5937 18957->18959 18958->18959 18960 ae5955 18958->18960 18961 af1187 std::locale::_Init 74 API calls 18959->18961 18962 af0d72 std::exception::exception 62 API calls 18960->18962 18963 ae5347 18961->18963 18964 ae596a 18962->18964 18963->18904 18965 af249b __CxxThrowException@8 KiUserExceptionDispatcher 18964->18965 18966 ae5981 18965->18966 18970 af0de2 18967->18970 18971 ae2e1d 18970->18971 18972 af0e02 _strlen 18970->18972 18971->18945 18972->18971 18973 af13a8 _malloc 62 API calls 18972->18973 18974 af0e15 18973->18974 18974->18971 18975 af5f82 _strcpy_s 62 API calls 18974->18975 18975->18971 18979 ae10c0 18976->18979 18980 ae10ed std::_String_base::_Xlen 18979->18980 18983 ae4570 18980->18983 18982 ae1116 18982->18934 18984 ae4588 18983->18984 18985 ae4583 18983->18985 18987 ae45ba 18984->18987 18988 ae459b 18984->18988 18999 aee395 18985->18999 18989 ae45c4 18987->18989 18991 aee35d std::_String_base::_Xlen 74 API calls 18987->18991 19007 ae4a30 18988->19007 18996 ae45d7 18989->18996 19013 ae5110 18989->19013 18991->18989 18994 ae4a30 std::_String_base::_Xlen 74 API calls 18995 ae45b1 18994->18995 18995->18982 18997 af0efb _memcpy_s 62 API calls 18996->18997 18998 ae45ea 18996->18998 18997->18998 18998->18982 19000 aee3a1 __EH_prolog3 18999->19000 19001 ae3bd0 std::_String_base::_Xlen 74 API calls 19000->19001 19002 aee3ae 19001->19002 19026 ae1150 19002->19026 19005 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19006 aee3cc 19005->19006 19008 ae4a3e 19007->19008 19010 ae4a43 19007->19010 19009 aee395 std::_String_base::_Xlen 74 API calls 19008->19009 19009->19010 19012 ae45a7 19010->19012 19029 af0f78 19010->19029 19012->18994 19014 ae514d 19013->19014 19015 ae517f 19014->19015 19016 ae519b 19014->19016 19017 af1187 std::locale::_Init 74 API calls 19015->19017 19018 af0d72 std::exception::exception 62 API calls 19016->19018 19023 ae5187 19017->19023 19019 ae51aa 19018->19019 19020 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19019->19020 19022 ae51bf 19020->19022 19021 ae5209 ctype 19021->18996 19045 ae58d0 19022->19045 19023->18996 19023->19021 19025 af0efb _memcpy_s 62 API calls 19023->19025 19025->19021 19027 ae10c0 std::_String_base::_Xlen 74 API calls 19026->19027 19028 ae115d 19027->19028 19028->19005 19030 af0fa1 19029->19030 19031 af0f88 19029->19031 19030->19012 19032 af0f8d 19031->19032 19033 af0fad 19031->19033 19034 af47a6 __sopen_helper 62 API calls 19032->19034 19035 af0fb2 19033->19035 19036 af0fc0 19033->19036 19037 af0f92 19034->19037 19038 af47a6 __sopen_helper 62 API calls 19035->19038 19041 af5ff0 19036->19041 19040 af1323 __sopen_helper 6 API calls 19037->19040 19038->19037 19040->19030 19042 af6008 19041->19042 19043 af6037 19042->19043 19044 af602f __VEC_memcpy 19042->19044 19043->19030 19044->19043 19046 ae58ec 19045->19046 19047 ae58db 19045->19047 19046->19047 19048 ae58f8 19046->19048 19049 af1187 std::locale::_Init 74 API calls 19047->19049 19050 af0d72 std::exception::exception 62 API calls 19048->19050 19051 ae58e3 19049->19051 19052 ae590e 19050->19052 19051->19023 19053 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19052->19053 19054 ae5925 19053->19054 19056 ae2e3a _memset __write_nolock 19055->19056 19057 ae2f19 19056->19057 19059 ae2e7a GetFileVersionInfoSizeW 19056->19059 19058 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19057->19058 19060 ae2f29 19058->19060 19059->19057 19061 ae2e8d 19059->19061 19060->17921 19061->19057 19062 ae2e98 GetFileVersionInfoW 19061->19062 19062->19057 19063 ae2eaa VerQueryValueW 19062->19063 19063->19057 19064 ae2ec7 _memset 19063->19064 19073 af1a33 19064->19073 19067 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19068 ae2f12 19067->19068 19068->17921 19070 ae3da6 19069->19070 19070->19070 19071 ae4c60 74 API calls 19070->19071 19072 ae3031 19071->19072 19072->17925 19074 af1a63 19073->19074 19075 af1a43 19073->19075 19077 af1a8f 19074->19077 19079 af1a72 19074->19079 19076 af47a6 __sopen_helper 62 API calls 19075->19076 19078 af1a48 19076->19078 19082 af9e4d __woutput_l 98 API calls 19077->19082 19080 af1323 __sopen_helper 6 API calls 19078->19080 19081 af47a6 __sopen_helper 62 API calls 19079->19081 19086 ae2efc 19080->19086 19083 af1a77 19081->19083 19084 af1ac3 19082->19084 19085 af1323 __sopen_helper 6 API calls 19083->19085 19084->19086 19087 af1ad1 19084->19087 19088 af7c50 __flsbuf 96 API calls 19084->19088 19085->19086 19086->19067 19087->19086 19089 af7c50 __flsbuf 96 API calls 19087->19089 19088->19087 19089->19086 19091 ae4d1b 19090->19091 19093 ae4d20 19090->19093 19092 aee395 std::_String_base::_Xlen 74 API calls 19091->19092 19092->19093 19094 af0f78 _memmove_s 63 API calls 19093->19094 19095 ae4784 19093->19095 19094->19095 19095->17958 19097 ae9094 19096->19097 19100 ae9052 19096->19100 19098 ae90ac 19097->19098 19099 aee35d std::_String_base::_Xlen 74 API calls 19097->19099 19101 ae90c3 19098->19101 19102 aee35d std::_String_base::_Xlen 74 API calls 19098->19102 19105 ae90ed 19098->19105 19099->19098 19100->19097 19104 ae907b 19100->19104 19103 ae5110 std::_String_base::_Xlen 74 API calls 19101->19103 19107 ae90d6 19101->19107 19102->19101 19103->19107 19110 aea0c0 19104->19110 19105->17977 19107->19105 19109 af0efb _memcpy_s 62 API calls 19107->19109 19109->19105 19111 aea0d7 19110->19111 19112 aea0d2 19110->19112 19114 aea0fa 19111->19114 19115 aee35d std::_String_base::_Xlen 74 API calls 19111->19115 19113 aee395 std::_String_base::_Xlen 74 API calls 19112->19113 19113->19111 19116 aea111 19114->19116 19117 aee35d std::_String_base::_Xlen 74 API calls 19114->19117 19119 ae908d 19114->19119 19115->19114 19118 ae5110 std::_String_base::_Xlen 74 API calls 19116->19118 19120 aea124 19116->19120 19117->19116 19118->19120 19119->17977 19120->19119 19121 af0efb _memcpy_s 62 API calls 19120->19121 19121->19119 19123 af1187 std::locale::_Init 74 API calls 19122->19123 19124 ae70e7 19123->19124 19125 ae4950 19124->19125 19126 ae49a3 19125->19126 19130 ae495d 19125->19130 19127 ae49b1 19126->19127 19128 aee35d std::_String_base::_Xlen 74 API calls 19126->19128 19129 ae5110 std::_String_base::_Xlen 74 API calls 19127->19129 19131 ae49c4 19127->19131 19128->19127 19129->19131 19130->19126 19132 ae4986 19130->19132 19133 af0efb _memcpy_s 62 API calls 19131->19133 19135 ae49dc 19131->19135 19134 ae4570 std::_String_base::_Xlen 74 API calls 19132->19134 19133->19135 19136 ae499d 19134->19136 19135->17982 19136->17982 19138 ae878f 19137->19138 19139 ae878a 19137->19139 19141 ae879e 19138->19141 19142 af1349 6 API calls 19138->19142 19140 af1349 6 API calls 19139->19140 19140->19138 19145 ae93f0 19141->19145 19142->19141 19146 ae93fc 19145->19146 19147 af1349 6 API calls 19146->19147 19148 ae940f 19146->19148 19147->19148 19149 ae942d 19148->19149 19150 af1349 6 API calls 19148->19150 19151 ae9442 19149->19151 19152 af1349 6 API calls 19149->19152 19150->19149 19153 ae3246 19151->19153 19154 af0f78 _memmove_s 63 API calls 19151->19154 19152->19151 19153->17985 19154->19153 19156 ae6bbf 19155->19156 19157 ae6bc3 MultiByteToWideChar 19155->19157 19156->19157 19158 ae6bd9 19157->19158 19160 ae6c2b 19157->19160 19159 ae4750 74 API calls 19158->19159 19165 ae6bf3 ctype 19159->19165 19161 ae6c5c MultiByteToWideChar 19160->19161 19168 ae6c92 19160->19168 19163 ae6c77 19161->19163 19162 ae4750 74 API calls 19162->19165 19163->19163 19167 ae4b80 74 API calls 19163->19167 19164 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19166 ae6d0d 19164->19166 19165->19164 19166->17991 19230 ae80e0 19166->19230 19167->19168 19168->19162 19170 ae6ed8 _memset __write_nolock 19169->19170 19171 ae6fae InternetCrackUrlW 19170->19171 19172 ae6fd8 19171->19172 19173 ae6fe2 19171->19173 19174 af1d4a _printf 100 API calls 19172->19174 19175 ae4c60 74 API calls 19173->19175 19174->19173 19176 ae700b 19175->19176 19177 ae4c60 74 API calls 19176->19177 19180 ae703e 19177->19180 19178 ae7067 19179 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19178->19179 19181 ae7089 19179->19181 19180->19178 19182 ae4b80 74 API calls 19180->19182 19183 ae7800 InternetOpenW 19181->19183 19182->19178 19184 ae72ad 19183->19184 19184->18003 19184->18004 19186 ae78de 19185->19186 19187 ae78e6 InternetConnectW 19185->19187 19186->19187 19188 ae72f4 19187->19188 19188->18009 19188->18010 19190 ae798f 19189->19190 19191 ae7997 HttpOpenRequestW 19189->19191 19190->19191 19192 ae7336 19191->19192 19192->18015 19192->18016 19194 ae737b 19193->19194 19194->18021 19194->18022 19196 ae73ac 19195->19196 19196->18026 19196->18031 19330 ae9520 19197->19330 19202 aeb6c0 19203 aeb700 19202->19203 19585 ae9710 19203->19585 19205 ae6920 74 API calls 19206 aeb80c 19205->19206 19207 aeb824 19206->19207 19591 aea200 19206->19591 19210 ae73dc 19207->19210 19595 aeeb53 19207->19595 19212 ae8180 19210->19212 19213 ae9710 75 API calls 19212->19213 19214 ae81be 19213->19214 19231 ae8133 19230->19231 19232 ae8121 InternetCloseHandle 19230->19232 19231->17991 19232->19231 19677 ae7b60 HttpQueryInfoW 19233->19677 19236 ae4750 74 API calls 19238 ae7d34 19236->19238 19240 ae6d20 76 API calls 19238->19240 19244 ae7d3b ctype 19240->19244 19241 ae7c90 19243 ae7b60 HttpQueryInfoW 19241->19243 19242 af1349 6 API calls 19242->19241 19245 ae7ca2 19243->19245 19246 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19244->19246 19248 ae7cb6 19245->19248 19249 af1349 6 API calls 19245->19249 19247 ae7489 19246->19247 19247->18041 19250 ae4c60 74 API calls 19248->19250 19249->19248 19251 ae7cd9 ctype 19250->19251 19251->19236 19253 ae7b60 HttpQueryInfoW 19252->19253 19254 ae7e00 19253->19254 19256 ae8640 75 API calls 19254->19256 19274 ae7fc4 ctype 19254->19274 19255 af0d52 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 19257 ae8058 19255->19257 19258 ae7e50 19256->19258 19257->18069 19259 ae7e67 19258->19259 19260 af1349 6 API calls 19258->19260 19261 ae7b60 HttpQueryInfoW 19259->19261 19260->19259 19262 ae7e7b 19261->19262 19263 ae7e8f 19262->19263 19264 af1349 6 API calls 19262->19264 19265 ae4c60 74 API calls 19263->19265 19264->19263 19266 ae7eb9 19265->19266 19267 ae4750 74 API calls 19266->19267 19268 ae7ee0 19267->19268 19269 ae6d20 76 API calls 19268->19269 19270 ae7ee9 19269->19270 19270->19274 19701 ae8150 19270->19701 19273 ae4570 std::_String_base::_Xlen 74 API calls 19275 ae7f4e ctype 19273->19275 19274->19255 19275->19274 19276 ae8150 74 API calls 19275->19276 19277 ae7f8e 19276->19277 19278 ae4570 std::_String_base::_Xlen 74 API calls 19277->19278 19282 ae80b7 19281->19282 19282->18070 19284 ae8721 19283->19284 19285 ae8735 19284->19285 19286 ae874b 19284->19286 19287 af1349 6 API calls 19284->19287 19285->18079 19704 ae9340 19286->19704 19287->19286 19291 af1d56 __free_locale 19290->19291 19292 af1d64 19291->19292 19293 af1d81 __flsbuf 19291->19293 19294 af47a6 __sopen_helper 62 API calls 19292->19294 19737 af8f17 19293->19737 19295 af1d69 19294->19295 19296 af1323 __sopen_helper 6 API calls 19295->19296 19300 af1d79 __free_locale 19296->19300 19298 af1d93 __flsbuf 19742 afb5b3 19298->19742 19300->18070 19301 af1da5 __flsbuf 19302 af7db4 __output_l 98 API calls 19301->19302 19303 af1dbd __flsbuf 19302->19303 19308 ae948c 19307->19308 19309 ae9491 19307->19309 19310 af1349 6 API calls 19308->19310 19311 ae94a4 19309->19311 19312 af1349 6 API calls 19309->19312 19310->19309 19313 ae93f0 63 API calls 19311->19313 19312->19311 19314 ae94b7 19313->19314 19315 ae94c4 19314->19315 19316 af1349 6 API calls 19314->19316 19317 aea430 75 API calls 19315->19317 19316->19315 19318 ae94d8 19317->19318 19318->18070 19320 ae86df 19319->19320 19321 ae86e4 19319->19321 19322 af1349 6 API calls 19320->19322 19321->18070 19322->19321 19769 aebfe0 19323->19769 19325 aeb91b 19325->18070 19327 ae4660 19326->19327 19328 ae4950 std::_String_base::_Xlen 74 API calls 19327->19328 19329 ae4670 19328->19329 19329->17300 19344 aea2a0 19330->19344 19333 aea330 19579 aeeb19 19333->19579 19336 af1187 std::locale::_Init 74 API calls 19337 aea375 19336->19337 19338 ae73c7 19337->19338 19339 aee6d5 std::locale::_Init 78 API calls 19337->19339 19338->19202 19340 aea383 19339->19340 19341 aee427 std::_Lockit::_Lockit EnterCriticalSection 19340->19341 19342 aea397 19341->19342 19343 aee44f _tidy_global LeaveCriticalSection 19342->19343 19343->19338 19351 ae6a80 19344->19351 19346 aea2eb 19363 aeb4c0 19346->19363 19349 ae881a 19349->19333 19352 ae6920 74 API calls 19351->19352 19353 ae6ab1 19352->19353 19354 af1187 std::locale::_Init 74 API calls 19353->19354 19355 ae6ab8 19354->19355 19356 ae6af8 19355->19356 19394 aee6d5 19355->19394 19356->19346 19358 ae6ac6 19410 aee427 19358->19410 19362 ae6aee 19362->19346 19472 ae6a50 19363->19472 19368 aee427 std::_Lockit::_Lockit EnterCriticalSection 19369 aeb51d 19368->19369 19370 aee44f _tidy_global LeaveCriticalSection 19369->19370 19371 aea2fb 19370->19371 19371->19349 19372 ae6920 19371->19372 19373 ae6a39 19372->19373 19374 ae6963 19372->19374 19373->19349 19375 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19374->19375 19377 ae6972 19374->19377 19375->19377 19376 ae69b6 19379 ae69fa 19376->19379 19382 ae3bd0 std::_String_base::_Xlen 74 API calls 19376->19382 19377->19376 19378 ae3bd0 std::_String_base::_Xlen 74 API calls 19377->19378 19381 ae6985 19378->19381 19380 ae3bd0 std::_String_base::_Xlen 74 API calls 19379->19380 19383 ae6a08 19380->19383 19575 ae61f0 19381->19575 19385 ae69c9 19382->19385 19386 ae61f0 74 API calls 19383->19386 19388 ae61f0 74 API calls 19385->19388 19389 ae6a22 19386->19389 19391 ae69e3 19388->19391 19392 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19389->19392 19390 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19390->19376 19393 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19391->19393 19392->19373 19393->19379 19395 aee6e1 __EH_prolog3 19394->19395 19396 aee767 std::locale::_Locimp::_Locimp_dtor 19395->19396 19397 aee427 std::_Lockit::_Lockit EnterCriticalSection 19395->19397 19396->19358 19398 aee6f5 19397->19398 19400 af1187 std::locale::_Init 74 API calls 19398->19400 19409 aee751 19398->19409 19399 aee44f _tidy_global LeaveCriticalSection 19399->19396 19401 aee70a 19400->19401 19403 aee71e 19401->19403 19418 aee62e 19401->19418 19422 aee509 19403->19422 19406 ae4650 std::locale::_Init 74 API calls 19407 aee744 19406->19407 19426 ae64b0 19407->19426 19409->19399 19411 ae6ad9 19410->19411 19412 aee439 19410->19412 19414 aee44f 19411->19414 19470 aeeb81 EnterCriticalSection 19412->19470 19415 aee456 19414->19415 19416 aee464 19414->19416 19471 aeeb91 LeaveCriticalSection 19415->19471 19416->19362 19419 aee63a __EH_prolog3 19418->19419 19420 ae3bd0 std::_String_base::_Xlen 74 API calls 19419->19420 19421 aee66d std::locale::_Locimp::_Locimp_dtor 19420->19421 19421->19403 19423 aee528 19422->19423 19424 aee517 19422->19424 19423->19406 19431 aeeba1 19424->19431 19427 aee427 std::_Lockit::_Lockit EnterCriticalSection 19426->19427 19428 ae64bf 19427->19428 19429 aee44f _tidy_global LeaveCriticalSection 19428->19429 19430 ae64d4 19429->19430 19430->19409 19432 aeebaf 19431->19432 19432->19423 19433 af2970 19432->19433 19435 af7a6c __NMSG_WRITE 62 API calls 19432->19435 19443 afc851 19433->19443 19435->19433 19437 af2981 _memset 19439 af2a59 19437->19439 19441 af2a19 SetUnhandledExceptionFilter UnhandledExceptionFilter 19437->19441 19467 af79ea 19439->19467 19441->19439 19444 af7212 __decode_pointer 6 API calls 19443->19444 19445 af2976 19444->19445 19445->19437 19446 afc85e 19445->19446 19448 afc86a __free_locale 19446->19448 19447 afc8c6 19450 afc8a7 19447->19450 19452 afc8d5 19447->19452 19448->19447 19449 afc891 19448->19449 19448->19450 19456 afc88d 19448->19456 19451 af73e5 __getptd_noexit 62 API calls 19449->19451 19454 af7212 __decode_pointer 6 API calls 19450->19454 19453 afc896 _siglookup 19451->19453 19455 af47a6 __sopen_helper 62 API calls 19452->19455 19459 afc93c 19453->19459 19460 af79ea _abort 62 API calls 19453->19460 19466 afc89f __free_locale 19453->19466 19454->19453 19457 afc8da 19455->19457 19456->19449 19456->19452 19458 af1323 __sopen_helper 6 API calls 19457->19458 19458->19466 19461 af6501 __lock 62 API calls 19459->19461 19462 afc947 19459->19462 19460->19459 19461->19462 19463 af7209 _doexit 6 API calls 19462->19463 19464 afc97c 19462->19464 19463->19464 19465 afc9d2 _raise LeaveCriticalSection 19464->19465 19465->19466 19466->19437 19468 af78a8 _doexit 62 API calls 19467->19468 19469 af2a60 19468->19469 19470->19411 19471->19416 19473 aee427 std::_Lockit::_Lockit EnterCriticalSection 19472->19473 19474 ae6a64 19473->19474 19475 aee44f _tidy_global LeaveCriticalSection 19474->19475 19476 ae6a79 19475->19476 19477 aeb570 19476->19477 19478 aee427 std::_Lockit::_Lockit EnterCriticalSection 19477->19478 19479 aeb5a0 19478->19479 19480 aee427 std::_Lockit::_Lockit EnterCriticalSection 19479->19480 19484 aeb5e8 19479->19484 19481 aeb5c6 19480->19481 19482 aee44f _tidy_global LeaveCriticalSection 19481->19482 19482->19484 19483 aee44f _tidy_global LeaveCriticalSection 19486 aeb500 19483->19486 19497 aeb625 19484->19497 19498 ae65f0 19484->19498 19486->19368 19486->19371 19487 aeb634 19488 aeb659 19487->19488 19510 af0e62 19487->19510 19490 aee427 std::_Lockit::_Lockit EnterCriticalSection 19488->19490 19492 aeb66e 19490->19492 19494 aee44f _tidy_global LeaveCriticalSection 19492->19494 19493 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19493->19488 19495 aeb683 19494->19495 19513 aee5c8 19495->19513 19497->19483 19499 ae6632 19498->19499 19509 ae66b5 ctype 19498->19509 19500 af1187 std::locale::_Init 74 API calls 19499->19500 19499->19509 19501 ae6642 19500->19501 19502 ae668d 19501->19502 19519 ae6580 19501->19519 19502->19509 19530 ae6350 19502->19530 19509->19487 19511 af0d72 std::exception::exception 62 API calls 19510->19511 19512 aeb64a 19511->19512 19512->19493 19514 aee5d6 19513->19514 19515 aee5e0 19513->19515 19561 aee466 19514->19561 19517 af1187 std::locale::_Init 74 API calls 19515->19517 19518 aee5e8 19517->19518 19518->19497 19520 ae4570 std::_String_base::_Xlen 74 API calls 19519->19520 19521 ae65a4 19520->19521 19522 ae62c0 19521->19522 19523 aee427 std::_Lockit::_Lockit EnterCriticalSection 19522->19523 19524 ae62f0 19523->19524 19535 aee76f 19524->19535 19527 ae65b0 19545 aee8d8 19527->19545 19557 aee606 19530->19557 19532 ae6386 ctype 19533 aee44f _tidy_global LeaveCriticalSection 19532->19533 19534 ae640c 19533->19534 19534->19509 19536 aee77f 19535->19536 19537 af3983 _setlocale 113 API calls 19536->19537 19538 aee790 19537->19538 19539 ae4650 std::locale::_Init 74 API calls 19538->19539 19540 aee7a7 19539->19540 19541 af3983 _setlocale 113 API calls 19540->19541 19542 aee7b3 19540->19542 19541->19542 19543 ae4650 std::locale::_Init 74 API calls 19542->19543 19544 ae632d 19543->19544 19544->19527 19546 af42ee ____lc_handle_func 70 API calls 19545->19546 19547 aee8e3 19546->19547 19548 af42c8 ____lc_codepage_func 70 API calls 19547->19548 19549 aee8f0 19548->19549 19558 aee614 19557->19558 19560 aee62a 19557->19560 19559 af3983 _setlocale 113 API calls 19558->19559 19559->19560 19560->19532 19562 af1a1c __cinit 73 API calls 19561->19562 19564 aee473 19562->19564 19563 aee47e 19563->19515 19564->19563 19565 af2970 19564->19565 19567 af7a6c __NMSG_WRITE 62 API calls 19564->19567 19566 afc851 _abort 6 API calls 19565->19566 19568 af2976 19566->19568 19567->19565 19569 af2981 _memset 19568->19569 19570 afc85e _raise 62 API calls 19568->19570 19571 af2a59 19569->19571 19573 af2a19 SetUnhandledExceptionFilter UnhandledExceptionFilter 19569->19573 19570->19569 19572 af79ea _abort 62 API calls 19571->19572 19574 af2a60 19572->19574 19573->19571 19576 ae621c std::_String_base::_Xlen 19575->19576 19577 ae4570 std::_String_base::_Xlen 74 API calls 19576->19577 19578 ae6245 19577->19578 19578->19390 19580 af1187 std::locale::_Init 74 API calls 19579->19580 19581 aeeb25 19580->19581 19584 aeeb61 InitializeCriticalSection 19581->19584 19583 aea366 19583->19336 19584->19583 19586 ae974d 19585->19586 19587 ae9745 19585->19587 19589 ae9770 19586->19589 19601 ae8300 19586->19601 19598 aeeb4a 19587->19598 19589->19205 19589->19206 19592 aea280 19591->19592 19593 aea241 19591->19593 19592->19207 19593->19592 19594 ae6920 74 API calls 19593->19594 19594->19592 19606 aeeb91 LeaveCriticalSection 19595->19606 19597 aeeb5a 19597->19210 19605 aeeb81 EnterCriticalSection 19598->19605 19600 aeeb51 19600->19586 19603 ae8311 19601->19603 19602 ae8348 19602->19589 19603->19602 19604 ae6920 74 API calls 19603->19604 19604->19602 19605->19600 19606->19597 19678 ae7bb9 19677->19678 19678->19251 19679 ae8640 19678->19679 19680 af1187 std::locale::_Init 74 API calls 19679->19680 19681 ae866d 19680->19681 19684 ae92f0 19681->19684 19685 ae7c7c 19684->19685 19686 ae9300 19684->19686 19685->19241 19685->19242 19687 ae930a 19686->19687 19690 aea600 19686->19690 19689 ae58d0 std::_String_base::_Xlen 74 API calls 19687->19689 19689->19685 19691 ae4950 std::_String_base::_Xlen 74 API calls 19690->19691 19692 aea64e 19691->19692 19693 ae10c0 std::_String_base::_Xlen 74 API calls 19692->19693 19694 aea664 19693->19694 19695 af249b __CxxThrowException@8 KiUserExceptionDispatcher 19694->19695 19696 aea67b 19695->19696 19697 aea697 19696->19697 19700 aeeb91 LeaveCriticalSection 19696->19700 19697->19687 19699 aeeb5a 19699->19687 19700->19699 19702 ae4570 std::_String_base::_Xlen 74 API calls 19701->19702 19703 ae7f37 19702->19703 19703->19273 19705 ae9359 19704->19705 19706 ae9355 19704->19706 19707 ae9362 19705->19707 19708 af1349 6 API calls 19705->19708 19718 aea430 19706->19718 19707->19706 19710 af1349 6 API calls 19707->19710 19708->19707 19710->19706 19711 ae9393 19712 ae93a0 19711->19712 19713 af1349 6 API calls 19711->19713 19714 af1349 6 API calls 19712->19714 19715 ae93b1 19712->19715 19713->19712 19714->19715 19716 af1349 6 API calls 19715->19716 19717 ae875c 19715->19717 19716->19717 19717->18079 19719 aea442 19718->19719 19720 aea464 19719->19720 19721 aea600 75 API calls 19719->19721 19733 aea553 _memset 19719->19733 19722 aea52e 19720->19722 19727 aea473 19720->19727 19721->19720 19723 aea596 19722->19723 19724 aea544 19722->19724 19725 aea5ac 19723->19725 19726 af0f78 _memmove_s 63 API calls 19723->19726 19728 af0f78 _memmove_s 63 API calls 19724->19728 19724->19733 19730 af0f78 _memmove_s 63 API calls 19725->19730 19725->19733 19726->19725 19729 ae58d0 std::_String_base::_Xlen 74 API calls 19727->19729 19728->19733 19731 aea495 19729->19731 19730->19733 19732 aea4d4 19731->19732 19734 af0f78 _memmove_s 63 API calls 19731->19734 19735 aea4f5 ctype 19732->19735 19736 af0f78 _memmove_s 63 API calls 19732->19736 19733->19711 19734->19732 19735->19711 19736->19735 19738 af8f3a EnterCriticalSection 19737->19738 19739 af8f24 19737->19739 19738->19298 19740 af6501 __lock 62 API calls 19739->19740 19741 af8f2d 19740->19741 19741->19298 19743 af8c09 __fileno 62 API calls 19742->19743 19744 afb5c2 19743->19744 19745 b005d7 __write_nolock 62 API calls 19744->19745 19746 afb5c8 __flsbuf 19745->19746 19747 af4685 __malloc_crt 62 API calls 19746->19747 19748 afb615 19746->19748 19747->19748 19748->19301 19770 aec006 19769->19770 19771 af1349 6 API calls 19770->19771 19772 aec00f 19770->19772 19771->19772 19773 aec04a 19772->19773 19774 aea600 75 API calls 19772->19774 19779 aec116 19772->19779 19775 aec107 19773->19775 19776 aec05c 19773->19776 19774->19773 19777 af0f78 _memmove_s 63 API calls 19775->19777 19775->19779 19778 ae58d0 std::_String_base::_Xlen 74 API calls 19776->19778 19777->19779 19780 aec07e 19778->19780 19779->19325 19781 aec097 19780->19781 19783 af0f78 _memmove_s 63 API calls 19780->19783 19782 aec0b6 19781->19782 19784 af0f78 _memmove_s 63 API calls 19781->19784 19785 aec0d1 ctype 19782->19785 19786 af0f78 _memmove_s 63 API calls 19782->19786 19783->19781 19784->19782 19785->19325 19786->19785 19862 aecfa0 19787->19862 19792 aec870 19793 aec8f9 19792->19793 19794 aecd46 19793->19794 19863 af1187 std::locale::_Init 74 API calls 19862->19863 19864 aecfcc 19863->19864 19872 ae4800 19864->19872 19867 aed380 19868 af1187 std::locale::_Init 74 API calls 19867->19868 19869 aed3ac 19868->19869 19875 ae50d0 19869->19875 19873 af1187 std::locale::_Init 74 API calls 19872->19873 19874 ae480a 19873->19874 19874->19867 19876 af1187 std::locale::_Init 74 API calls 19875->19876 19877 ae50da 19876->19877 19877->19792 20519 af78b4 __free_locale 20518->20519 20520 af6501 __lock 62 API calls 20519->20520 20521 af78bb 20520->20521 20522 af7984 __initterm 20521->20522 20523 af78e7 20521->20523 20537 af79bf 20522->20537 20525 af7212 __decode_pointer 6 API calls 20523->20525 20527 af78f2 20525->20527 20529 af7974 __initterm 20527->20529 20531 af7212 __decode_pointer 6 API calls 20527->20531 20528 af79bc __free_locale 20528->17390 20529->20522 20535 af7907 20531->20535 20532 af79b3 20533 af77b8 _doexit 3 API calls 20532->20533 20533->20528 20534 af7209 6 API calls _doexit 20534->20535 20535->20529 20535->20534 20536 af7212 6 API calls __decode_pointer 20535->20536 20536->20535 20538 af79a0 20537->20538 20539 af79c5 20537->20539 20538->20528 20541 af6427 LeaveCriticalSection 20538->20541 20542 af6427 LeaveCriticalSection 20539->20542 20541->20532 20542->20538

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 00AE71B0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 0 ae71b0-ae7234 call af5c90 call ae4570 call ae6b60 7 ae7236-ae723f call ae80e0 0->7 8 ae7242-ae7247 0->8 7->8 10 ae7249-ae7252 call ae80e0 8->10 11 ae7255-ae7259 8->11 10->11 13 ae725b-ae7264 call ae80e0 11->13 14 ae7266-ae7296 call ae4c60 11->14 13->14 21 ae729b-ae72b1 call ae6ec0 call ae7800 14->21 22 ae7298 14->22 27 ae72da-ae72e5 21->27 28 ae72b3-ae72d5 call af0d72 call af249b 21->28 22->21 30 ae72ea-ae72fc call ae7890 27->30 31 ae72e7 27->31 28->27 36 ae72fe-ae731a call af0d72 call af249b 30->36 37 ae731f-ae7325 30->37 31->30 36->37 39 ae732a-ae733e call ae7940 37->39 40 ae7327 37->40 45 ae7367-ae7370 39->45 46 ae7340-ae7362 call af0d72 call af249b 39->46 40->39 48 ae7375-ae7380 call ae79f0 45->48 49 ae7372 45->49 46->45 54 ae7382-ae739e call af0d72 call af249b 48->54 55 ae73a3-ae73b1 call ae7a70 48->55 49->48 54->55 60 ae742c-ae7433 call ae7af0 55->60 61 ae73b3-ae73fc GetLastError call ae87c0 call aeb6c0 call ae8180 call ae88f0 55->61 67 ae745c-ae74b2 call ae7be0 call ae4570 call ae3c40 60->67 68 ae7435-ae7457 call af0d72 call af249b 60->68 83 ae73fe-ae7404 61->83 84 ae7406-ae7409 61->84 87 ae771f-ae7768 call af0d72 call af249b call ae4650 67->87 88 ae74b8-ae74c9 67->88 68->67 86 ae740c-ae7427 call af0d72 call af249b 83->86 84->86 86->60 91 ae74cb 88->91 92 ae74d1-ae7510 call af1b1c call ae7be0 call ae4570 call ae3c40 88->92 91->92 109 ae76f8-ae771a call af0d72 call af249b 92->109 110 ae7516-ae755c call ae4570 call ae3bd0 call ae7d80 call ae3c40 92->110 109->87 122 ae755e-ae7564 110->122 123 ae7575-ae757c 110->123 124 ae7569-ae7572 call af1b1c 122->124 125 ae7566 122->125 126 ae7583-ae75b0 call ae85e0 call ae8060 123->126 124->123 125->124 133 ae75bd-ae7638 call ae86a0 call ae8710 call ae3c40 * 2 call ae7790 call ae3d70 * 2 call af0d52 126->133 134 ae75b2-ae75b7 126->134 134->133 135 ae763b-ae7670 call af1d4a call ae9470 134->135 145 ae7677-ae76f3 call af4320 call ae86f0 * 2 call ae86d0 call aeb8f0 call ae86a0 135->145 146 ae7672 call af1349 135->146 145->126 146->145
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AE6B60: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00AE6BCD
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE72C4
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE72D5
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE730C
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE731A
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE7351
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE7362
                                                                                                                                                                                          • Part of subcall function 00AE80E0: InternetCloseHandle.WININET(?), ref: 00AE8122
                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,0000000F), ref: 00AE73B3
                                                                                                                                                                                          • Part of subcall function 00AE8180: std::_Lockit::_Lockit.LIBCPMT ref: 00AE81F6
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE7416
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE7427
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE7446
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE7457
                                                                                                                                                                                        • _printf.LIBCMT ref: 00AE764F
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE7709
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE771A
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE7730
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE739E
                                                                                                                                                                                          • Part of subcall function 00AF249B: KiUserExceptionDispatcher.NTDLL(?,?,00AF11EB,?,?,?,?,?,00AF11EB,?,00B0C4F0,00B11320), ref: 00AF24DD
                                                                                                                                                                                          • Part of subcall function 00AE7A70: HttpSendRequestW.WININET(?,00000000,00000000,00B0AA8F,00000000), ref: 00AE7AB9
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AE7390
                                                                                                                                                                                          • Part of subcall function 00AF0D72: _strlen.LIBCMT ref: 00AF0D8C
                                                                                                                                                                                          • Part of subcall function 00AF0D72: _malloc.LIBCMT ref: 00AF0D95
                                                                                                                                                                                          • Part of subcall function 00AF0D72: _strcpy_s.LIBCMT ref: 00AF0DA7
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE7741
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Exception@8Throwstd::exception::exception$ByteCharCloseDispatcherErrorExceptionHandleHttpInternetLastLockitLockit::_MultiRequestSendUserWide_malloc_printf_strcpy_s_strlenstd::_
                                                                                                                                                                                        • String ID: %s$Accept: */*$Error:SendRequest failed dwErr:$X-Interval
                                                                                                                                                                                        • API String ID: 473927878-2315201066
                                                                                                                                                                                        • Opcode ID: d3f5e6a08878cd16b5f0bfc58366992473a3bc26c99c7cba4e763f68865bcfbd
                                                                                                                                                                                        • Instruction ID: 25b93fc8c217acf1e104e2390ab10ddc10d59cf52732524cceb7f080c03fde99
                                                                                                                                                                                        • Opcode Fuzzy Hash: d3f5e6a08878cd16b5f0bfc58366992473a3bc26c99c7cba4e763f68865bcfbd
                                                                                                                                                                                        • Instruction Fuzzy Hash: 40029171904289DBDF14EFA5CD41BEEBBB4BF14300F508559F91967282EB74AA08CBA1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE2F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AE2F5C
                                                                                                                                                                                        • SHGetValueW.SHLWAPI ref: 00AE2F94
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AE2FBD
                                                                                                                                                                                        • PathCombineW.SHLWAPI(?,?,Bin\360Desktop.exe,?,?), ref: 00AE2FD7
                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(?), ref: 00AE2FE2
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AE3006
                                                                                                                                                                                          • Part of subcall function 00AE2E30: _memset.LIBCMT ref: 00AE2E5A
                                                                                                                                                                                          • Part of subcall function 00AE2E30: GetFileVersionInfoSizeW.VERSION(?,00000000), ref: 00AE2E80
                                                                                                                                                                                          • Part of subcall function 00AE2E30: GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,00000000), ref: 00AE2EA1
                                                                                                                                                                                          • Part of subcall function 00AE2E30: VerQueryValueW.VERSION(?,00B0AAC4,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00AE2EBE
                                                                                                                                                                                          • Part of subcall function 00AE2E30: _memset.LIBCMT ref: 00AE2ECF
                                                                                                                                                                                          • Part of subcall function 00AE2E30: __snwprintf.LIBCMT ref: 00AE2EF7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe, xrefs: 00AE2F7A
                                                                                                                                                                                        • Bin\360Desktop.exe, xrefs: 00AE2FC5
                                                                                                                                                                                        • Path, xrefs: 00AE2F75
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$File$InfoPathValueVersion$CombineExistsQuerySize__snwprintf
                                                                                                                                                                                        • String ID: Bin\360Desktop.exe$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe
                                                                                                                                                                                        • API String ID: 3634268210-1130433031
                                                                                                                                                                                        • Opcode ID: a7595faa6a15d5897fffac0fe618f4344a0e3f622bf792ddf6549a50da409774
                                                                                                                                                                                        • Instruction ID: 40ffe88bbfcdfd9dfeaf7676ecb7ffa7bb7fb8c3994759665a0ad0b77436f804
                                                                                                                                                                                        • Opcode Fuzzy Hash: a7595faa6a15d5897fffac0fe618f4344a0e3f622bf792ddf6549a50da409774
                                                                                                                                                                                        • Instruction Fuzzy Hash: C52194B2604341ABD720DF61DC4ABEB77E9AFD8700F404D2DB689C3191EB749258C792
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE6EC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 130networkCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 191 ae6ec0-ae6fd6 call af5c90 call af5ae0 * 4 InternetCrackUrlW 202 ae6fd8-ae6fe2 call af1d4a 191->202 203 ae6fe5-ae6fef 191->203 202->203 205 ae6ff2-ae6ffb 203->205 205->205 207 ae6ffd-ae701d call ae4c60 205->207 210 ae7020-ae7029 207->210 210->210 211 ae702b-ae7043 call ae4c60 210->211 214 ae7067-ae708f call af0d52 211->214 215 ae7045-ae704e 211->215 216 ae7050-ae7059 215->216 216->216 218 ae705b-ae7062 call ae4b80 216->218 218->214
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$CrackInternet_printf
                                                                                                                                                                                        • String ID: <$Error:InternetCrackUrl failed!
                                                                                                                                                                                        • API String ID: 2405482379-3291073569
                                                                                                                                                                                        • Opcode ID: d446e9524792087f23140cb2937f6e0504cb9b239d7b5409aea834ed5a8dcf17
                                                                                                                                                                                        • Instruction ID: cc266b0256e1cbaca3944339816396b5424fa0cb5c294216b2d221892d898d56
                                                                                                                                                                                        • Opcode Fuzzy Hash: d446e9524792087f23140cb2937f6e0504cb9b239d7b5409aea834ed5a8dcf17
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E51D3715087418FD324DF65C945BABB7E9FF88740F008A2DF68AC7281EB75A608CB52
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE2E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 221 ae2e30-ae2e6c call af5c90 call af5ae0 226 ae2f19-ae2f2f call af0d52 221->226 227 ae2e72-ae2e74 221->227 227->226 229 ae2e7a-ae2e87 GetFileVersionInfoSizeW 227->229 229->226 231 ae2e8d-ae2e92 229->231 231->226 232 ae2e98-ae2ea8 GetFileVersionInfoW 231->232 232->226 233 ae2eaa-ae2ec5 VerQueryValueW 232->233 233->226 234 ae2ec7-ae2f18 call af5ae0 call af1a33 call af0d52 233->234
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AE2E5A
                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,00000000), ref: 00AE2E80
                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,00000000), ref: 00AE2EA1
                                                                                                                                                                                        • VerQueryValueW.VERSION(?,00B0AAC4,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00AE2EBE
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AE2ECF
                                                                                                                                                                                        • __snwprintf.LIBCMT ref: 00AE2EF7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileInfoVersion_memset$QuerySizeValue__snwprintf
                                                                                                                                                                                        • String ID: %d.%d.%d.%d
                                                                                                                                                                                        • API String ID: 3281049495-3491811756
                                                                                                                                                                                        • Opcode ID: 62aabe3b345f6becccd867f448512e5bf36f098c65b5503730b905d9ab7c0a32
                                                                                                                                                                                        • Instruction ID: 2a8b0932a35667937fe93bd9b262d662151d7788247137abd11e82aeb48faf9b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 62aabe3b345f6becccd867f448512e5bf36f098c65b5503730b905d9ab7c0a32
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4221A8B56043006AE314DBA1CD42F7BB3ECAF94700F84892DBB49961D3EA78D954C7A6
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEFCC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 241 aefcc0-aefcde 242 aefe3d-aefe54 call af0d52 241->242 243 aefce4-aefce7 241->243 243->242 245 aefced-aefd3d call af5ae0 SHGetValueA 243->245 245->242 249 aefd43-aefd4d 245->249 250 aefd50-aefd55 249->250 250->250 251 aefd57-aefd5c 250->251 251->242 252 aefd62-aefd74 251->252 253 aefd76-aefd7b 252->253 254 aefd8e-aefd90 253->254 255 aefd7d-aefd82 253->255 256 aefd92 254->256 257 aefd93-aefdad 254->257 255->254 258 aefd84-aefd8a 255->258 256->257 260 aefdb0-aefdb8 257->260 258->253 259 aefd8c 258->259 259->256 261 aefdba-aefdbf 260->261 262 aefdcb-aefdcd 260->262 261->262 263 aefdc1-aefdc7 261->263 264 aefdcf 262->264 265 aefdd0-aefe14 call af5ae0 call aeeec0 lstrcmpiA 262->265 263->260 266 aefdc9 263->266 264->265 265->242 271 aefe16-aefe3c call aeecf0 call af0d52 265->271 266->264
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEFD0C
                                                                                                                                                                                        • SHGetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,?,?,?,?,00000400), ref: 00AEFD35
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEFDE2
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,?), ref: 00AEFE0A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$Valuelstrcmpi
                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                        • API String ID: 999496690-2395435937
                                                                                                                                                                                        • Opcode ID: 284952c277deb78cadb134c01f1e0fb91fcc0398c3fc365e33d4c8d22ca3c3be
                                                                                                                                                                                        • Instruction ID: 8d54229f0676791b3782f2368393626727abce3805b20d1274e89a38ab8c6d22
                                                                                                                                                                                        • Opcode Fuzzy Hash: 284952c277deb78cadb134c01f1e0fb91fcc0398c3fc365e33d4c8d22ca3c3be
                                                                                                                                                                                        • Instruction Fuzzy Hash: F44117315043898FD735CF65CD95BFB7BE8EF95708F04492CE98987185EB30A9098B92
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE5280 Relevance: 4.6, APIs: 3, Instructions: 116COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 276 ae5280-ae52bc 277 ae52be-ae52c0 276->277 278 ae52c2-ae52d4 276->278 279 ae52e4-ae52ee 277->279 278->279 280 ae52d6-ae52df 278->280 282 ae5302-ae530c 279->282 283 ae52f0 279->283 280->279 281 ae52e1 280->281 281->279 284 ae530e-ae534f call af0d72 call af249b call ae5930 282->284 285 ae52f2-ae52f6 call af1187 282->285 283->285 289 ae52fb-ae535e 285->289 293 ae5383-ae5387 289->293 294 ae5360-ae5364 289->294 298 ae5398-ae53a8 293->298 299 ae5389-ae5395 call af0ef0 293->299 296 ae536b 294->296 297 ae5366-ae5369 294->297 304 ae536e-ae5380 call af0efb 296->304 297->304 301 ae53ac-ae53c3 298->301 302 ae53aa 298->302 299->298 302->301 304->293
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Exception@8Throw_memcpy_sstd::exception::exception
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 464988439-0
                                                                                                                                                                                        • Opcode ID: c3308b716dc4db41ee0a4307e3746903bed2069fc81e6d9a719a3063746bc479
                                                                                                                                                                                        • Instruction ID: 7d2c2a8ac4e098e4b0a6f255d8cd431b9f6073059c0c1f7bae2271303f355422
                                                                                                                                                                                        • Opcode Fuzzy Hash: c3308b716dc4db41ee0a4307e3746903bed2069fc81e6d9a719a3063746bc479
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6641C671E00A45ABCB04DFBAC9919AEF7F5FF48314B10462EE526D7741D770AA14CBA0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AFC379 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 308 afc379-afc388 GetEnvironmentStringsW 309 afc38e-afc391 308->309 310 afc38a-afc38d 308->310 311 afc393-afc398 309->311 312 afc3a1-afc3aa call af4685 309->312 311->311 313 afc39a-afc39f 311->313 315 afc3af-afc3b4 312->315 313->311 313->312 316 afc3b6-afc3c2 FreeEnvironmentStringsW 315->316 317 afc3c3-afc3ce call af4320 315->317 317->316
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(00000000,00AF2338), ref: 00AFC37C
                                                                                                                                                                                        • __malloc_crt.LIBCMT ref: 00AFC3AA
                                                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AFC3B7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: EnvironmentStrings$Free__malloc_crt
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 237123855-0
                                                                                                                                                                                        • Opcode ID: 48fb8aa0feef0e8479f5cc1c53f9ac4388a38547a34d8c3f49bb81f9d50a08c6
                                                                                                                                                                                        • Instruction ID: 5abc907d9003ac66c79acf7bed5292c45c902b9cddd6b309119991867baab641
                                                                                                                                                                                        • Opcode Fuzzy Hash: 48fb8aa0feef0e8479f5cc1c53f9ac4388a38547a34d8c3f49bb81f9d50a08c6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 69F0273B50102C5ECB6077B67E048BB627EEEDA3B63228625F6D2C7100FE304E4342A0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF1187 Relevance: 4.5, APIs: 3, Instructions: 34COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 320 af1187-af118f 321 af119e-af11a9 call af13a8 320->321 324 af11ab-af11ac 321->324 325 af1191-af119c call af7167 321->325 325->321 328 af11ad-af11b9 325->328 329 af11bb-af11d3 call af116c call af1a1c 328->329 330 af11d4-af11eb call ae2e10 call af249b 328->330 329->330
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _malloc.LIBCMT ref: 00AF11A1
                                                                                                                                                                                          • Part of subcall function 00AF13A8: __FF_MSGBANNER.LIBCMT ref: 00AF13CB
                                                                                                                                                                                          • Part of subcall function 00AF13A8: __NMSG_WRITE.LIBCMT ref: 00AF13D2
                                                                                                                                                                                          • Part of subcall function 00AF13A8: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00AF4696,?,00000001,?,?,00AF648B,00000018,00B0C0B8,0000000C,00AF651C), ref: 00AF141F
                                                                                                                                                                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 00AF11C4
                                                                                                                                                                                          • Part of subcall function 00AF116C: std::exception::exception.LIBCMT ref: 00AF1178
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AF11E6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3715980512-0
                                                                                                                                                                                        • Opcode ID: 938cb20b0bfbc947de3b75b437bc94521255a154200e35965be05cf7dc2b847e
                                                                                                                                                                                        • Instruction ID: dfef5f2f8229bbdbc3b58cc09ed996bb49974bf8dd5c9df80e3a6bade4154e05
                                                                                                                                                                                        • Opcode Fuzzy Hash: 938cb20b0bfbc947de3b75b437bc94521255a154200e35965be05cf7dc2b847e
                                                                                                                                                                                        • Instruction Fuzzy Hash: B6F0273990020CB6CF04B7E5ED12ABE3F988B40354B904568FF10664E2DF6099458B48
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE7940 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48networkCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 339 ae7940-ae798d 340 ae798f-ae7994 339->340 341 ae7997-ae79e8 HttpOpenRequestW 339->341 340->341
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HttpOpenRequestW.WININET(?,GET,?,00000000,00000000,00000000,844C8200,00000000), ref: 00AE79AA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: HttpOpenRequest
                                                                                                                                                                                        • String ID: GET
                                                                                                                                                                                        • API String ID: 1984915467-1805413626
                                                                                                                                                                                        • Opcode ID: 47a8f44c5c19360fd8c0cc86455b2dca17403df6478b6649d4382cb94a9ee14c
                                                                                                                                                                                        • Instruction ID: 6b937c4464b51d8a26a351e9610e6b9f3fb4d245ba8ebff347d74f0156bd5a09
                                                                                                                                                                                        • Opcode Fuzzy Hash: 47a8f44c5c19360fd8c0cc86455b2dca17403df6478b6649d4382cb94a9ee14c
                                                                                                                                                                                        • Instruction Fuzzy Hash: FE0140B1A44348AFDB10CF99CC05BAFBFB8FB04B14F10466AF515A72D0D77999008B94
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE7800 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38networkCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 344 ae7800-ae788a InternetOpenW
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InternetOpenW.WININET(WinInetGet/0.1,00000000,00000000,00000000,00000000), ref: 00AE784E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InternetOpen
                                                                                                                                                                                        • String ID: WinInetGet/0.1
                                                                                                                                                                                        • API String ID: 2038078732-3566862317
                                                                                                                                                                                        • Opcode ID: a6a97d93f913bd304db4f20f44ae2a78bba294cffbf4a903a0b537a7336a09d4
                                                                                                                                                                                        • Instruction ID: 99c8852ad8f97845166d5fdf772a13aef0b706f619f21f783f48caa98749f9ff
                                                                                                                                                                                        • Opcode Fuzzy Hash: a6a97d93f913bd304db4f20f44ae2a78bba294cffbf4a903a0b537a7336a09d4
                                                                                                                                                                                        • Instruction Fuzzy Hash: FE01AF71A44348BBD720CF99DC46FAEBFB8FB05B20F20462AF111A72D0D77565008B94
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE524E Relevance: 3.1, APIs: 2, Instructions: 93COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 347 ae524e-ae5255 348 ae5257-ae5260 call af0ef0 347->348 349 ae5263-ae52bc call af249b 347->349 348->349 355 ae52be-ae52c0 349->355 356 ae52c2-ae52d4 349->356 357 ae52e4-ae52ee 355->357 356->357 358 ae52d6-ae52df 356->358 360 ae5302-ae530c 357->360 361 ae52f0 357->361 358->357 359 ae52e1 358->359 359->357 362 ae530e-ae534f call af0d72 call af249b call ae5930 360->362 363 ae52f2-ae52f6 call af1187 360->363 361->363 367 ae52fb-ae535e 363->367 371 ae5383-ae5387 367->371 372 ae5360-ae5364 367->372 376 ae5398-ae53a8 371->376 377 ae5389-ae5395 call af0ef0 371->377 374 ae536b 372->374 375 ae5366-ae5369 372->375 382 ae536e-ae5380 call af0efb 374->382 375->382 379 ae53ac-ae53c3 376->379 380 ae53aa 376->380 377->376 380->379 382->371
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Exception@8Throw_memcpy_s
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4160651998-0
                                                                                                                                                                                        • Opcode ID: 55de406922ccdafb63fee4cebb0487f34a9dd5b26f397ce0c88542635fae0d7a
                                                                                                                                                                                        • Instruction ID: 65d188dbce6e7d2ebe1c67059bf9a5838eefdfe2875d38e420ef7d8c83dc648d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 55de406922ccdafb63fee4cebb0487f34a9dd5b26f397ce0c88542635fae0d7a
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE31E4B1D00A45EBCB24DFAAD891B6AB3B5FF44704F104A2EF92687A41D770B914C7D0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF77B8 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 386 af77b8-af77c9 call af778d ExitProcess
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ___crtCorExitProcess.LIBCMT ref: 00AF77C0
                                                                                                                                                                                          • Part of subcall function 00AF778D: GetModuleHandleW.KERNEL32(mscoree.dll,?,00AF77C5,?,?,00AF13E1,000000FF,0000001E,?,00AF4696,?,00000001,?,?,00AF648B,00000018), ref: 00AF7797
                                                                                                                                                                                          • Part of subcall function 00AF778D: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AF77A7
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00AF77C9
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2427264223-0
                                                                                                                                                                                        • Opcode ID: 6ad81749b8486f6b6e3ac9bd838fefe1d1e727fba191111ac69a00a46ffeaf07
                                                                                                                                                                                        • Instruction ID: 64902024d8cae612f084a73ae3f503a479ad170de4060195f353f39adf031826
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ad81749b8486f6b6e3ac9bd838fefe1d1e727fba191111ac69a00a46ffeaf07
                                                                                                                                                                                        • Instruction Fuzzy Hash: B4B0923100814CBBCB013F52DD4AC5D3F2AEF943A1B204020FA281A031DFB2EE929EC4
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE7890 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 389 ae7890-ae78dc 390 ae78de-ae78e3 389->390 391 ae78e6-ae7936 InternetConnectW 389->391 390->391
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AE78F8
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ConnectInternet
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3050416762-0
                                                                                                                                                                                        • Opcode ID: 19d2c57060792baf0c53431ebe72a26435b711aaf1f6d899f6dbb5549c679381
                                                                                                                                                                                        • Instruction ID: 2b7bea79cd4fd217a2e8166ae913152b7397dcfa9129614b75f5bdf2aa770ad7
                                                                                                                                                                                        • Opcode Fuzzy Hash: 19d2c57060792baf0c53431ebe72a26435b711aaf1f6d899f6dbb5549c679381
                                                                                                                                                                                        • Instruction Fuzzy Hash: 520192B1A44308AFDB20CFA9CD45BAEBBF8FB08710F10462AF515E72C0D77556008B94
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE4DA0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 394 ae4da0-ae4da9 395 ae4dab call aee35d 394->395 396 ae4db0-ae4db5 394->396 395->396 398 ae4dcc-ae4dce 396->398 399 ae4db7-ae4dbd call ae5280 396->399 401 ae4df2-ae4dfb 398->401 402 ae4dd0-ae4dd6 398->402 403 ae4dc2-ae4dcb 399->403 404 ae4dea-ae4def 402->404 405 ae4dd8-ae4de9 402->405 404->401
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • std::_String_base::_Xlen.LIBCPMT ref: 00AE4DAB
                                                                                                                                                                                          • Part of subcall function 00AEE35D: __EH_prolog3.LIBCMT ref: 00AEE364
                                                                                                                                                                                          • Part of subcall function 00AEE35D: __CxxThrowException@8.LIBCMT ref: 00AEE38F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1675473389-0
                                                                                                                                                                                        • Opcode ID: 0c573315f04515f14719906bd303578919e1ef26043a2e3dbf037b9f020c1b35
                                                                                                                                                                                        • Instruction ID: d7611aff3fec33ac12f747cb471024706ebc3382721b11ec2feac2aaf6127f63
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c573315f04515f14719906bd303578919e1ef26043a2e3dbf037b9f020c1b35
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EF0E932B045624A9B74EE3ABD8047F32E7EFD8710319CE2DE092CB584DD3098854354
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE80E0 Relevance: 1.5, APIs: 1, Instructions: 35networkCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 406 ae80e0-ae811f 407 ae8133-ae814b 406->407 408 ae8121-ae8128 InternetCloseHandle 406->408 408->407
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InternetCloseHandle.WININET(?), ref: 00AE8122
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandleInternet
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1081599783-0
                                                                                                                                                                                        • Opcode ID: 350455f248a15cf34cd027028b280cbeb6594709ed2a7f138648c4141dd509e3
                                                                                                                                                                                        • Instruction ID: 73262764b17d24c087464045d0a3900fded4ec4acde77eebf73cfee2e475117d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 350455f248a15cf34cd027028b280cbeb6594709ed2a7f138648c4141dd509e3
                                                                                                                                                                                        • Instruction Fuzzy Hash: D4F09671A44748EBC710CFA9DD45B9ABFB8FB15B61F10066AF515D3690DB3455008690
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF6355 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00AF636A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: 8a92070e0c08353ed12a4306a1f5ec2b0514723aa4828ef799dde1f05451233f
                                                                                                                                                                                        • Instruction ID: 4a2cf3438ed22835b7c3017dfb921cabc007ae27dc5c46adf91d2ae267511947
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a92070e0c08353ed12a4306a1f5ec2b0514723aa4828ef799dde1f05451233f
                                                                                                                                                                                        • Instruction Fuzzy Hash: D1D05E765543095ADB005FB57C087A23BEC9388B95F048435BA4DC7150F970C6408A00
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF79D4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _doexit.LIBCMT ref: 00AF79E0
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __lock.LIBCMT ref: 00AF78B6
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __decode_pointer.LIBCMT ref: 00AF78ED
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __decode_pointer.LIBCMT ref: 00AF7902
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __decode_pointer.LIBCMT ref: 00AF792C
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __decode_pointer.LIBCMT ref: 00AF7942
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __decode_pointer.LIBCMT ref: 00AF794F
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __initterm.LIBCMT ref: 00AF797E
                                                                                                                                                                                          • Part of subcall function 00AF78A8: __initterm.LIBCMT ref: 00AF798E
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1597249276-0
                                                                                                                                                                                        • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                        • Instruction ID: e3cacb566ae750c1424d37970dfda13d70506ad135009c0f660d46489c670bd3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BB0927258420C33EA212582AC07F1A3A1987C0BA0E240020BA0C191A1A9A2A9A180D9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                        Function 00AFCA0E Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ___getlocaleinfo
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1937885557-0
                                                                                                                                                                                        • Opcode ID: 728d16797899a298231453e87e2a7349129bdf53b9ab2312ecac204b9942e84d
                                                                                                                                                                                        • Instruction ID: bc1b8e65c04b53eaf02d476191e68c7916b5dca96aaf121c282696e1b702c9fa
                                                                                                                                                                                        • Opcode Fuzzy Hash: 728d16797899a298231453e87e2a7349129bdf53b9ab2312ecac204b9942e84d
                                                                                                                                                                                        • Instruction Fuzzy Hash: B4E1B0B290020DBEEF11DEE1CE85DFFB7BDFB08744F04096AB255E2051EA75AA059760
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE3070 Relevance: 37.5, APIs: 4, Strings: 17, Instructions: 726COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AE3100
                                                                                                                                                                                          • Part of subcall function 00AF00C0: _memset.LIBCMT ref: 00AF0101
                                                                                                                                                                                          • Part of subcall function 00AF00C0: _memset.LIBCMT ref: 00AF011E
                                                                                                                                                                                          • Part of subcall function 00AF00C0: lstrlenA.KERNEL32(00000000), ref: 00AF012D
                                                                                                                                                                                          • Part of subcall function 00AE4AC0: std::_String_base::_Xlen.LIBCPMT ref: 00AE4AF5
                                                                                                                                                                                          • Part of subcall function 00AE4AC0: _memcpy_s.LIBCMT ref: 00AE4B44
                                                                                                                                                                                          • Part of subcall function 00AE6D20: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00AE6D8C
                                                                                                                                                                                          • Part of subcall function 00AE71B0: std::exception::exception.LIBCMT ref: 00AE72C4
                                                                                                                                                                                          • Part of subcall function 00AE71B0: __CxxThrowException@8.LIBCMT ref: 00AE72D5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$ByteCharException@8MultiString_base::_ThrowWideXlen_memcpy_slstrlenstd::_std::exception::exception
                                                                                                                                                                                        • String ID: &count=16&show=1&version=$1.0$10004$UTF-8$\360Desktop$\TopBarCfgImport.xml$book$cate$child$cid$count$encoding$http://relate.apc.360.cn/index.php?c=Relate&a=getRelateCate&mid=$relate_type$standalone$version$zm_d
                                                                                                                                                                                        • API String ID: 2241216071-3947748357
                                                                                                                                                                                        • Opcode ID: ed4a884864458601c88c6d2c6ea684eb6d875d8bdb13fdaf0a22303063de6d5c
                                                                                                                                                                                        • Instruction ID: 692e6f75b2facf867605959f4d4340f2f880b398848967ef0265ec8be21fb8cd
                                                                                                                                                                                        • Opcode Fuzzy Hash: ed4a884864458601c88c6d2c6ea684eb6d875d8bdb13fdaf0a22303063de6d5c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C6294729102C8DBDF34EFA5CE89BED77B4AF54300F104569E9096B292DB745B08CB61
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF080 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AEEDF0: _vswprintf_s.LIBCMT ref: 00AEEE23
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00AEF102
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00AEF148
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00AEF153
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEF1C8
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00AEF243
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandle$ControlCreateDeviceFile_memset_vswprintf_s
                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                        • API String ID: 759969516-2935326385
                                                                                                                                                                                        • Opcode ID: 0b37f8d95494e0dfef0dd4b22fd489047261e3c8c8533b229f048569ff3bd707
                                                                                                                                                                                        • Instruction ID: 0a7992c4123614ba8ec077eef8a09028cda0bb33429d0769a8d84ddb85dc2edc
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b37f8d95494e0dfef0dd4b22fd489047261e3c8c8533b229f048569ff3bd707
                                                                                                                                                                                        • Instruction Fuzzy Hash: 08518FB1508384AFE360DF65CC81BABBBE8EB88704F50492DF689C7281EB7495458F56
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AEEDF0: _vswprintf_s.LIBCMT ref: 00AEEE23
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,00AEFFDB,?,00000064), ref: 00AEF4B5
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEF4EA
                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 00AEF512
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEF52A
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00AEF578
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$CloseControlCreateDeviceFileHandle_vswprintf_s
                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                        • API String ID: 3752575622-2935326385
                                                                                                                                                                                        • Opcode ID: eca0b9e4723df4ab19a0ec7fa8f68330b511557053e28a85bed4ea41b16bd54c
                                                                                                                                                                                        • Instruction ID: 5740752363516a65707488340b5ca8d3c3994bd8ff65ecf219e0f2944075fcff
                                                                                                                                                                                        • Opcode Fuzzy Hash: eca0b9e4723df4ab19a0ec7fa8f68330b511557053e28a85bed4ea41b16bd54c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B416171504380AFE324DF65DD86EAFB7E8EBD9700F440E2DB58482191EB7096548B62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF5D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AEEDF0: _vswprintf_s.LIBCMT ref: 00AEEE23
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,?), ref: 00AEF632
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00AEF67C
                                                                                                                                                                                        • _malloc.LIBCMT ref: 00AEF68B
                                                                                                                                                                                          • Part of subcall function 00AF13A8: __FF_MSGBANNER.LIBCMT ref: 00AF13CB
                                                                                                                                                                                          • Part of subcall function 00AF13A8: __NMSG_WRITE.LIBCMT ref: 00AF13D2
                                                                                                                                                                                          • Part of subcall function 00AF13A8: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00AF4696,?,00000001,?,?,00AF648B,00000018,00B0C0B8,0000000C,00AF651C), ref: 00AF141F
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00AEF6B7
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00AEF702
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ControlDevice$AllocateCloseCreateFileHandleHeap_malloc_vswprintf_s
                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                        • API String ID: 15615210-2935326385
                                                                                                                                                                                        • Opcode ID: f5f3f70cbf94dcd57ae729d684ba271f6144edb70cf052cc78df78d49d259cbb
                                                                                                                                                                                        • Instruction ID: dabffeeb4b579746258b9f4f31a5a4a9dbc220923262d2183f56bc498b242b53
                                                                                                                                                                                        • Opcode Fuzzy Hash: f5f3f70cbf94dcd57ae729d684ba271f6144edb70cf052cc78df78d49d259cbb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 84319370604340AFE360DF65DC82F6BBAE8EB98714F10092DF699D61D1E7B0D5048B56
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF0D52 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 00AF5F37
                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AF5F4C
                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(00B08D48), ref: 00AF5F57
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 00AF5F73
                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 00AF5F7A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2579439406-0
                                                                                                                                                                                        • Opcode ID: e94f5d37d98b83a5d39ec495092f0ef19e678a1ca90832b1eeca6c1d58839d62
                                                                                                                                                                                        • Instruction ID: 8cbc15dee72ac30ed4d6745d7299defac8758137eca886592babd7405bad6aa4
                                                                                                                                                                                        • Opcode Fuzzy Hash: e94f5d37d98b83a5d39ec495092f0ef19e678a1ca90832b1eeca6c1d58839d62
                                                                                                                                                                                        • Instruction Fuzzy Hash: CF21FFB8900304AFD750DF68FD446A43BB4BB18B04F90895AE70887771EFB05A84CF19
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE8060 Relevance: 1.5, APIs: 1, Instructions: 38filenetworkCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InternetReadFile.WININET(?,?,?,?), ref: 00AE80A4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileInternetRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 778332206-0
                                                                                                                                                                                        • Opcode ID: 41c377b1237c31f750624bf5ee07a15517781a27590f3e1a99aadd8b7d3d536b
                                                                                                                                                                                        • Instruction ID: 9c8f8b919969b01360a9868f9cbbe6eb573485037e5ce8584536addaaff114d0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 41c377b1237c31f750624bf5ee07a15517781a27590f3e1a99aadd8b7d3d536b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 78F031B1904648EFC710CF99DD45BABBBB8FB49620F10462AF515D3690D73559008B90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AFBEE8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0001BEA6), ref: 00AFBEED
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                                                        • Opcode ID: dbc14e2d14980d31ea8760e05c0ce1b6693f1f5ae2431759efc3d00197bf2b81
                                                                                                                                                                                        • Instruction ID: 486d381b8bc9b640078a2d11c9e179f01230f8104879fe05902c66aa79c45505
                                                                                                                                                                                        • Opcode Fuzzy Hash: dbc14e2d14980d31ea8760e05c0ce1b6693f1f5ae2431759efc3d00197bf2b81
                                                                                                                                                                                        • Instruction Fuzzy Hash: 199002602655449AC70117B0DC4D95625AA7A59A1675108507241C5064EFA041049522
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEFBF0 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _vswprintf_s
                                                                                                                                                                                        • String ID: %s:%08x
                                                                                                                                                                                        • API String ID: 677850445-2617829732
                                                                                                                                                                                        • Opcode ID: e80923bc4a6fe0d68dacb1349f539108a772675b574a7d3c42806d716d2a37bf
                                                                                                                                                                                        • Instruction ID: 405801246723f560229c414b9e50c5b57ac442551f1dd8a6b9f0cd896e5d045b
                                                                                                                                                                                        • Opcode Fuzzy Hash: e80923bc4a6fe0d68dacb1349f539108a772675b574a7d3c42806d716d2a37bf
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE210EB2D04659AFCB14CFA9D941AEEBBF4FB48710F10852AE515E7240E6345900CB54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEC870 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 348COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • Unexpected end of Array: , xrefs: 00AEC9F7
                                                                                                                                                                                        • Unexpected character when parsing anytype: , xrefs: 00AECBAA
                                                                                                                                                                                        • Can't parse Json representation: , xrefs: 00AECCCB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: Can't parse Json representation: $Unexpected character when parsing anytype: $Unexpected end of Array:
                                                                                                                                                                                        • API String ID: 0-691214487
                                                                                                                                                                                        • Opcode ID: 08e6e83ff55ed6ef4ccd639297b9a5ef4c7c9f56b9d3277c7701b12e4012eba0
                                                                                                                                                                                        • Instruction ID: a93e8f06b0baee8045ea05dcdb9246b46e4830bb851795157fca591f00347124
                                                                                                                                                                                        • Opcode Fuzzy Hash: 08e6e83ff55ed6ef4ccd639297b9a5ef4c7c9f56b9d3277c7701b12e4012eba0
                                                                                                                                                                                        • Instruction Fuzzy Hash: A6D1B1714083C19BC734DB65C981BEBBBE4AFA9720F104D2DF19983292DB74A549CB93
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF850 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165registrystringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEF88F
                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?,?), ref: 00AEF8AA
                                                                                                                                                                                        • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?), ref: 00AEF8DC
                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?,?,?,?,?,?), ref: 00AEF906
                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32 ref: 00AEF93E
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEF957
                                                                                                                                                                                          • Part of subcall function 00AEF740: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 00AEF78E
                                                                                                                                                                                        • lstrcmpA.KERNEL32(?,00000000), ref: 00AEF988
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00AEF9D3
                                                                                                                                                                                        • RegEnumKeyExA.ADVAPI32(?,00000001,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?), ref: 00AEF9F9
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,?), ref: 00AEFA10
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 00AEF8A0
                                                                                                                                                                                        • ServiceName, xrefs: 00AEF92C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseEnumOpen_memset$CreateFileQueryValuelstrcmp
                                                                                                                                                                                        • String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
                                                                                                                                                                                        • API String ID: 2630661138-1795789498
                                                                                                                                                                                        • Opcode ID: 890c0f207de86e7f8dcd7db41d268b8f96dab041400b98abb9c7e25d5c4e460b
                                                                                                                                                                                        • Instruction ID: 961ee74bd0f0b9eac844b6328ffee81f9cb1347eaed8a8d1696825fafd37707d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 890c0f207de86e7f8dcd7db41d268b8f96dab041400b98abb9c7e25d5c4e460b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 63518EB1604381AFE720DB65CC85FBBB7E8EB94704F04492DB68997191EB70D908CB62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEFA70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 110COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Netbios_memset
                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$* $2$3$7
                                                                                                                                                                                        • API String ID: 192577218-1802369251
                                                                                                                                                                                        • Opcode ID: b02f4becb0518b7db86fcdcaf980ab797208dd399659ca0620379d3d71912edc
                                                                                                                                                                                        • Instruction ID: bccce83efac4335899569db48e6db736d2ede0d0d3724a3a84497b155276566a
                                                                                                                                                                                        • Opcode Fuzzy Hash: b02f4becb0518b7db86fcdcaf980ab797208dd399659ca0620379d3d71912edc
                                                                                                                                                                                        • Instruction Fuzzy Hash: D34138715183C05FD311DB26CC61BBBBBE8AF95300F44896DFAC987292D7B88609C762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AFF4F2 Relevance: 16.7, APIs: 11, Instructions: 166COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetStringTypeW.KERNEL32(00000001,00B08518,00000001,?,00000002,00000000,-0000009C,?,?,?,00AFF6DC,00000001,?,-00000080,?,?), ref: 00AFF521
                                                                                                                                                                                        • GetLastError.KERNEL32(?,00AFF6DC,00000001,?,-00000080,?,?,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?), ref: 00AFF533
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(-00000080,00000000,?,?,00000000,00000000,00000002,00000000,-0000009C,?,?,?,00AFF6DC,00000001,?,-00000080), ref: 00AFF598
                                                                                                                                                                                        • _malloc.LIBCMT ref: 00AFF5CD
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AFF5ED
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?,-00000080), ref: 00AFF602
                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00AFF610
                                                                                                                                                                                        • __freea.LIBCMT ref: 00AFF61A
                                                                                                                                                                                        • ___ansicp.LIBCMT ref: 00AFF644
                                                                                                                                                                                        • ___convertcp.LIBCMT ref: 00AFF665
                                                                                                                                                                                          • Part of subcall function 00AFF779: GetCPInfo.KERNEL32(?,-00000080,?,00000000,00000000,-0000009C,?,?,?,00AFF6DC,00000001,?,-00000080,?,?,?), ref: 00AFF7C4
                                                                                                                                                                                          • Part of subcall function 00AFF779: GetCPInfo.KERNEL32(?,00000001,?,00AFF6DC,00000001,?), ref: 00AFF7DD
                                                                                                                                                                                          • Part of subcall function 00AFF779: _strlen.LIBCMT ref: 00AFF7FB
                                                                                                                                                                                          • Part of subcall function 00AFF779: _memset.LIBCMT ref: 00AFF873
                                                                                                                                                                                          • Part of subcall function 00AFF779: MultiByteToWideChar.KERNEL32(?,00000001,?,00AFF6DC,?,00000000,?,?,?,?,?,?,?,00AFF6DC,00000001,?), ref: 00AFF88A
                                                                                                                                                                                          • Part of subcall function 00AFF779: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,00AFF6DC), ref: 00AFF8A5
                                                                                                                                                                                        • GetStringTypeA.KERNEL32(?,?,?,?,?,00000002,00000000,-0000009C,?,?,?,00AFF6DC,00000001,?,-00000080,?), ref: 00AFF685
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp___convertcp__freea_malloc_strlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 820197566-0
                                                                                                                                                                                        • Opcode ID: 1cb10b45023fd4761878f2443f9d623854b3d0f67eeae57862ea67ff934a22ab
                                                                                                                                                                                        • Instruction ID: d9632d382a66de91f704ab18f241c16dfe4414c1362aa1733ae547d2ed1f2dcb
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1cb10b45023fd4761878f2443f9d623854b3d0f67eeae57862ea67ff934a22ab
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B515D7290014EAFDF20AFA4DC819BE7BA9EF18394B144439FB15D7260EB30DD609B90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AED6A0 Relevance: 15.4, APIs: 10, Instructions: 376COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memmove_s$String_base::_Xlenstd::_$_memcpy_s
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3470545318-0
                                                                                                                                                                                        • Opcode ID: 1b867c94a445e4b682a2d460b2b270f86e3f297cee80e84601c57a3635c2e797
                                                                                                                                                                                        • Instruction ID: cd674a5f7d57b4f65257be43f395660ec88567367665c86d6970af0c73792835
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b867c94a445e4b682a2d460b2b270f86e3f297cee80e84601c57a3635c2e797
                                                                                                                                                                                        • Instruction Fuzzy Hash: 63C16D707142818FDB08CF1AC99492FBBB6FBC8794B244A1CF49997385C734E951CB96
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEC530 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 260COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _strncmp$_memcpy_s
                                                                                                                                                                                        • String ID: false$null$true
                                                                                                                                                                                        • API String ID: 4240207175-2913297407
                                                                                                                                                                                        • Opcode ID: fb5913d05310bb359f9044a01465979a01a2bad18c2bd09c8e2c1874bcd9e272
                                                                                                                                                                                        • Instruction ID: d091f24c17117db1f2765b2e708067436c62de6ba9c7e995f74075b232d9e487
                                                                                                                                                                                        • Opcode Fuzzy Hash: fb5913d05310bb359f9044a01465979a01a2bad18c2bd09c8e2c1874bcd9e272
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0CA1DFB15083829FD710DF69C980B2BBBE4AF99724F60091CF49597392E774EC46CB92
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF290 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AEEDF0: _vswprintf_s.LIBCMT ref: 00AEEE23
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 00AEF302
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEF32F
                                                                                                                                                                                        • _strncpy.LIBCMT ref: 00AEF36B
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00AEF3A1
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00AEF40B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle_memset_strncpy_vswprintf_s
                                                                                                                                                                                        • String ID: SCSIDISK$\\.\Scsi%d:
                                                                                                                                                                                        • API String ID: 170396225-2176293039
                                                                                                                                                                                        • Opcode ID: 048c25f3d9abe96978880443b079925b6b01046d8296d6591e0543efaf575dea
                                                                                                                                                                                        • Instruction ID: 760c96be9f758856871554377ddbfd78c72ba14efcb4aff3a6183be31d063b29
                                                                                                                                                                                        • Opcode Fuzzy Hash: 048c25f3d9abe96978880443b079925b6b01046d8296d6591e0543efaf575dea
                                                                                                                                                                                        • Instruction Fuzzy Hash: 384192B0608384AFE330DB25DD85FABB7E8EB84704F40092DB699971C1D7B5A508C757
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEB930 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEB95B
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEB981
                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 00AEBA05
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AEBA14
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEBA29
                                                                                                                                                                                        • std::locale::facet::facet_Register.LIBCPMT ref: 00AEBA44
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                        • String ID: bad cast
                                                                                                                                                                                        • API String ID: 2820251361-3145022300
                                                                                                                                                                                        • Opcode ID: 7104937b41b2f6f9b29ca1be880044c4765100a7c7919c582b2b3c31ed18a8ba
                                                                                                                                                                                        • Instruction ID: 6f09970c75f8e98d97f369c74f7e482244557c7430c191238f9a27fd899f3e05
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7104937b41b2f6f9b29ca1be880044c4765100a7c7919c582b2b3c31ed18a8ba
                                                                                                                                                                                        • Instruction Fuzzy Hash: A23124725143828FC714EF16D885F9B77E0EB44720F408A1DFAA2932D2DB70AD04CBA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEBA80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEBAAB
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEBAD1
                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 00AEBB55
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AEBB64
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEBB79
                                                                                                                                                                                        • std::locale::facet::facet_Register.LIBCPMT ref: 00AEBB94
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                        • String ID: bad cast
                                                                                                                                                                                        • API String ID: 2820251361-3145022300
                                                                                                                                                                                        • Opcode ID: fbfd376f698c2a4388a1b9fac4fbf233b179c6c08a393915529724cd9205027a
                                                                                                                                                                                        • Instruction ID: 8bcfd350b0ed7749ac967332e270a555e48077c5a2252b4c25a85fb10bf6e044
                                                                                                                                                                                        • Opcode Fuzzy Hash: fbfd376f698c2a4388a1b9fac4fbf233b179c6c08a393915529724cd9205027a
                                                                                                                                                                                        • Instruction Fuzzy Hash: C331DD725143828FC714EF19D885FAB77E0AB54720F444A1DF9A2932E1DB70A944CBA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEB570 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEB59B
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEB5C1
                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 00AEB645
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AEB654
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEB669
                                                                                                                                                                                        • std::locale::facet::facet_Register.LIBCPMT ref: 00AEB684
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                        • String ID: bad cast
                                                                                                                                                                                        • API String ID: 2820251361-3145022300
                                                                                                                                                                                        • Opcode ID: 3312d4b88e05483d0ce9c1fb491bc1774395e037d46890646f27e037a1ff7a07
                                                                                                                                                                                        • Instruction ID: e4154df7ba0cb17dbe6204a1a885caa07fc2e0b1312d2768f78c35d23604456b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3312d4b88e05483d0ce9c1fb491bc1774395e037d46890646f27e037a1ff7a07
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A310671614380CFD714EF1AD955B6B73E0EB54724F408A2DF466972D1DB70AD04CBA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE6920 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE696D
                                                                                                                                                                                          • Part of subcall function 00AF249B: KiUserExceptionDispatcher.NTDLL(?,?,00AF11EB,?,?,?,?,?,00AF11EB,?,00B0C4F0,00B11320), ref: 00AF24DD
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE69B1
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE69F5
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AE6A34
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Exception@8Throw$DispatcherExceptionUser
                                                                                                                                                                                        • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                        • API String ID: 4200477539-1866435925
                                                                                                                                                                                        • Opcode ID: 20248ebfaefff4063cd0c2530dd3ce6c33eab7aedc564c1a03e49eb609a35569
                                                                                                                                                                                        • Instruction ID: 34825ea1673302a5ee493789ce8262df555aaff0dbf6ca08594f62187295f90a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 20248ebfaefff4063cd0c2530dd3ce6c33eab7aedc564c1a03e49eb609a35569
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1431BF72198784AEC310DB64C852F9BBBE8AF98740F408F5CF1A9471D2EB70A108CB16
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEA430 Relevance: 10.7, APIs: 7, Instructions: 193COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memmove_s$_memset
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2102975174-0
                                                                                                                                                                                        • Opcode ID: 7f70eeb9fffccf85f40135295f620dc8808bce896d9c6378821d0c49bb37d5cb
                                                                                                                                                                                        • Instruction ID: 41f6ae34343b4c620e33ce93e004db100cd053df940bc7bc1f0e8e5dd6913088
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f70eeb9fffccf85f40135295f620dc8808bce896d9c6378821d0c49bb37d5cb
                                                                                                                                                                                        • Instruction Fuzzy Hash: C951F4726042455F8718DF3EC98483BBBA9EFD0354B04866DFD11DB38ADA70EC0587A2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEEEC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$__strlwr_strncat_vswprintf_s
                                                                                                                                                                                        • String ID: %02x
                                                                                                                                                                                        • API String ID: 259801040-560843007
                                                                                                                                                                                        • Opcode ID: 89b72774592d30a56ac68bcf12a68d1d04ce81701c492e5693aba846526ca620
                                                                                                                                                                                        • Instruction ID: a2fc761deb411560797aaa67eb9c08f75e623719965b205d379cb7a26c281520
                                                                                                                                                                                        • Opcode Fuzzy Hash: 89b72774592d30a56ac68bcf12a68d1d04ce81701c492e5693aba846526ca620
                                                                                                                                                                                        • Instruction Fuzzy Hash: CF41AD715087859FD334EB75CD95FEB7BE8AB84300F004A2DF69987152EA71E5088BA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AFF4EE Relevance: 9.1, APIs: 6, Instructions: 101COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetStringTypeW.KERNEL32(00000001,00B08518,00000001,?,00000002,00000000,-0000009C,?,?,?,00AFF6DC,00000001,?,-00000080,?,?), ref: 00AFF521
                                                                                                                                                                                        • GetLastError.KERNEL32(?,00AFF6DC,00000001,?,-00000080,?,?,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?), ref: 00AFF533
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(-00000080,00000000,?,?,00000000,00000000,00000002,00000000,-0000009C,?,?,?,00AFF6DC,00000001,?,-00000080), ref: 00AFF598
                                                                                                                                                                                        • _malloc.LIBCMT ref: 00AFF5CD
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AFF5ED
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?,-00000080), ref: 00AFF602
                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00AFF610
                                                                                                                                                                                        • __freea.LIBCMT ref: 00AFF61A
                                                                                                                                                                                        • ___ansicp.LIBCMT ref: 00AFF644
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiStringTypeWide$ErrorLast___ansicp__freea_malloc_memset
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2898540435-0
                                                                                                                                                                                        • Opcode ID: b41b9d68d8284d7ae843d707dceb0e693d52e5c18796343d352dc8d938590fbf
                                                                                                                                                                                        • Instruction ID: 4305ce3bf81eac732d4c9200cc3795f34f5de2fae4215f3cf7983fcd3c5c95ff
                                                                                                                                                                                        • Opcode Fuzzy Hash: b41b9d68d8284d7ae843d707dceb0e693d52e5c18796343d352dc8d938590fbf
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C317C71A0014EEFDB109FA4DC81EBE7BA9EF18394B504439FA05D7161EB70DE648BA0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF4B62 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __CreateFrameInfo.LIBCMT ref: 00AF4B8A
                                                                                                                                                                                          • Part of subcall function 00AF27C8: __getptd.LIBCMT ref: 00AF27D6
                                                                                                                                                                                          • Part of subcall function 00AF27C8: __getptd.LIBCMT ref: 00AF27E4
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF4B94
                                                                                                                                                                                          • Part of subcall function 00AF745E: __getptd_noexit.LIBCMT ref: 00AF7461
                                                                                                                                                                                          • Part of subcall function 00AF745E: __amsg_exit.LIBCMT ref: 00AF746E
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF4BA2
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF4BB0
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF4BBB
                                                                                                                                                                                        • _CallCatchBlock2.LIBCMT ref: 00AF4BE1
                                                                                                                                                                                          • Part of subcall function 00AF286D: __CallSettingFrame@12.LIBCMT ref: 00AF28B9
                                                                                                                                                                                          • Part of subcall function 00AF4C88: __getptd.LIBCMT ref: 00AF4C97
                                                                                                                                                                                          • Part of subcall function 00AF4C88: __getptd.LIBCMT ref: 00AF4CA5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1602911419-0
                                                                                                                                                                                        • Opcode ID: 2686c4f01f044205e00c56683de71178734a3edf15c3878f81915a88912d84d7
                                                                                                                                                                                        • Instruction ID: d8144b88d4a3ef0c95fa5369ca03f18a8424f44979aca9777ec145464e7d8e5c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2686c4f01f044205e00c56683de71178734a3edf15c3878f81915a88912d84d7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D11A771D0420DDFDB10EFE4DA45AAEBBB0FF08315F108169F928AB251DB399A159F90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF740 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AEEDF0: _vswprintf_s.LIBCMT ref: 00AEEE23
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 00AEF78E
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 00AEF7DD
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00AEF82D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle_vswprintf_s
                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
                                                                                                                                                                                        • API String ID: 2864800763-1525991222
                                                                                                                                                                                        • Opcode ID: c83e265bdbd664e37458b494e5176a850fe126745e050ad2a52eb67191d79e65
                                                                                                                                                                                        • Instruction ID: 2c9f05fd35dad454321c71700af651433243ff5c2305a9ba7b67b638b89fc447
                                                                                                                                                                                        • Opcode Fuzzy Hash: c83e265bdbd664e37458b494e5176a850fe126745e050ad2a52eb67191d79e65
                                                                                                                                                                                        • Instruction Fuzzy Hash: BF2105B11083446FE320EB64DCC5FFBB6ECAB99314F00491DB6E882191D6789A48C7A2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEF317 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlDeviceHandle_memset_strncpy
                                                                                                                                                                                        • String ID: SCSIDISK
                                                                                                                                                                                        • API String ID: 2460871282-255126371
                                                                                                                                                                                        • Opcode ID: 9f1ed60e8be0ec8172044231da3b2cab606cb2d4bd3112b77681618429018d1a
                                                                                                                                                                                        • Instruction ID: b7f37174cb52bcfedb9b3d4fc8f895ba6b7f8230ee1ca357ba9bc9ea9cfae354
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f1ed60e8be0ec8172044231da3b2cab606cb2d4bd3112b77681618429018d1a
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE219FB46083849EE330DB25D986FABB7D8EBC4704F40092DB789971C1DBB49509C757
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AED1A0 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: String_base::_Xlen_memmove_sstd::_
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2295234635-0
                                                                                                                                                                                        • Opcode ID: 33cffabe53d1dd94f144cb55d346e6e389398532a09499ccf979d970cfd4d110
                                                                                                                                                                                        • Instruction ID: a61f076267185e02c41515bc078350b3b3c87e510f01ff053ed12f8e156ff375
                                                                                                                                                                                        • Opcode Fuzzy Hash: 33cffabe53d1dd94f144cb55d346e6e389398532a09499ccf979d970cfd4d110
                                                                                                                                                                                        • Instruction Fuzzy Hash: 835114707002429FC704EE6BD9C096AB7A5FF95300B508A2DE5658B645D731F899CBE2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AFAE65 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AFAE71
                                                                                                                                                                                          • Part of subcall function 00AF745E: __getptd_noexit.LIBCMT ref: 00AF7461
                                                                                                                                                                                          • Part of subcall function 00AF745E: __amsg_exit.LIBCMT ref: 00AF746E
                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00AFAE91
                                                                                                                                                                                        • __lock.LIBCMT ref: 00AFAEA1
                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 00AFAEBE
                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(02B417F0), ref: 00AFAEE9
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4271482742-0
                                                                                                                                                                                        • Opcode ID: 9337da2f59a607313628fe464053b451931cc4a93529c9662e5539c1f920e8b2
                                                                                                                                                                                        • Instruction ID: 23e7772c575ca2a95c8ea4fea3355018937051078fc0b0499e60c613ee7d86be
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9337da2f59a607313628fe464053b451931cc4a93529c9662e5539c1f920e8b2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2901C472A007299BCB21ABE4D9057BE7760BF24760F004154FA1867690DF34A991CBD2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEA6A0 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 462COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AE6A50: std::_Lockit::_Lockit.LIBCPMT ref: 00AE6A5F
                                                                                                                                                                                          • Part of subcall function 00AEBA80: std::_Lockit::_Lockit.LIBCPMT ref: 00AEBAAB
                                                                                                                                                                                          • Part of subcall function 00AEBA80: std::_Lockit::_Lockit.LIBCPMT ref: 00AEBAD1
                                                                                                                                                                                        • std::_Lockit::_Lockit.LIBCPMT ref: 00AEA720
                                                                                                                                                                                        • _localeconv.LIBCMT ref: 00AEA7A8
                                                                                                                                                                                        • _strcspn.LIBCMT ref: 00AEA8FA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: LockitLockit::_std::_$_localeconv_strcspn
                                                                                                                                                                                        • String ID: e
                                                                                                                                                                                        • API String ID: 331173946-4024072794
                                                                                                                                                                                        • Opcode ID: 0b4959fcf7f5adfcb4fc4ab6c850136029fac21a9565e9439bc38b97e0476c15
                                                                                                                                                                                        • Instruction ID: 62bde5acb95ffaf78c2a2983140e1486e2f3722119515a56e58b2bcb60ece433
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b4959fcf7f5adfcb4fc4ab6c850136029fac21a9565e9439bc38b97e0476c15
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C1246756083809FD324DF29C981BABBBE5AFD9300F05891DF9899B352D770A905CB93
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEFE60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 00AEFE84
                                                                                                                                                                                          • Part of subcall function 00AEEEC0: _memset.LIBCMT ref: 00AEEEF5
                                                                                                                                                                                          • Part of subcall function 00AEEEC0: _memset.LIBCMT ref: 00AEEF9B
                                                                                                                                                                                          • Part of subcall function 00AEEEC0: _strncat.LIBCMT ref: 00AEF01F
                                                                                                                                                                                        • SHSetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,00000001,?,?,?,?,?,?,?), ref: 00AEFF19
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$Value_strncat
                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                        • API String ID: 4177196402-2395435937
                                                                                                                                                                                        • Opcode ID: 004136fc72238ab3edae3d64fe0fff97896d98ced647e8f440547fb24f1842b9
                                                                                                                                                                                        • Instruction ID: 79de34f6e146fb19de85ab7f13653608ac744ab69468c27e2005557094f1b963
                                                                                                                                                                                        • Opcode Fuzzy Hash: 004136fc72238ab3edae3d64fe0fff97896d98ced647e8f440547fb24f1842b9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D112931604381AFD734DB21C952BFB77D8EF95700F54896DF58987192EE70A60C8392
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF4F0F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ___BuildCatchObject.LIBCMT ref: 00AF4F22
                                                                                                                                                                                          • Part of subcall function 00AF4E7D: ___BuildCatchObjectHelper.LIBCMT ref: 00AF4EB3
                                                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 00AF4F39
                                                                                                                                                                                        • ___FrameUnwindToState.LIBCMT ref: 00AF4F47
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                        • API String ID: 2163707966-1018135373
                                                                                                                                                                                        • Opcode ID: 43700127078e775d7443150afe1c24d5bc7444f6e3cfefefd6efd9a8d886ee7e
                                                                                                                                                                                        • Instruction ID: 6aa78c968a8466d3c3ca173744f715d635d68a31ccb0e0e35556116df737a3e0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 43700127078e775d7443150afe1c24d5bc7444f6e3cfefefd6efd9a8d886ee7e
                                                                                                                                                                                        • Instruction Fuzzy Hash: E101EF3140110EBBEF22AF91CD45EBB7E6AEF18394F008010BE1815161D736E9A1EBA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00B0405A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(KERNEL32,00AFB79A), ref: 00B0405F
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00B0406F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleModuleProc
                                                                                                                                                                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                        • API String ID: 1646373207-3105848591
                                                                                                                                                                                        • Opcode ID: f7a89fcaadd8a4dfaf32fbfc2bb4ea05de45aa5da32a7772ce7d85a707b8bdc1
                                                                                                                                                                                        • Instruction ID: 09d68ee263e0b0bd5d015058e4b16e410c211e57cfab5cd8d765348cca02fe24
                                                                                                                                                                                        • Opcode Fuzzy Hash: f7a89fcaadd8a4dfaf32fbfc2bb4ea05de45aa5da32a7772ce7d85a707b8bdc1
                                                                                                                                                                                        • Instruction Fuzzy Hash: FFF03070A40A0DD2DF101BA1BD0A76F7FB9FB90741F9608D0D6D6B10D4EF7180B49286
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEBFE0 Relevance: 6.2, APIs: 4, Instructions: 177COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memmove_s
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 800865076-0
                                                                                                                                                                                        • Opcode ID: a880a037f773624411f5b619f1a17cc51c6bf59eb992e74ea3f84a1a746af63f
                                                                                                                                                                                        • Instruction ID: e1f78274cf75f84b8582933f47d3af43a6c2c94585fbd32ee7d25619c73842fe
                                                                                                                                                                                        • Opcode Fuzzy Hash: a880a037f773624411f5b619f1a17cc51c6bf59eb992e74ea3f84a1a746af63f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7151B4757047819FC724DF7AC99083BB7E5AF99324B148A6CE496C7702EA30ED0AC761
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF1711 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __flush.LIBCMT ref: 00AF17D5
                                                                                                                                                                                        • __fileno.LIBCMT ref: 00AF17F5
                                                                                                                                                                                        • __locking.LIBCMT ref: 00AF17FC
                                                                                                                                                                                        • __flsbuf.LIBCMT ref: 00AF1827
                                                                                                                                                                                          • Part of subcall function 00AF47A6: __getptd_noexit.LIBCMT ref: 00AF47A6
                                                                                                                                                                                          • Part of subcall function 00AF1323: __decode_pointer.LIBCMT ref: 00AF132E
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3240763771-0
                                                                                                                                                                                        • Opcode ID: ed00166549562d5b7f34f2984b0fda4c470dfeb9c5d3f16d29785296e0cca32a
                                                                                                                                                                                        • Instruction ID: 7f240e13511920bfecdc2affffe14fc6faca5fe33839e7e0da4a43c2c78a820a
                                                                                                                                                                                        • Opcode Fuzzy Hash: ed00166549562d5b7f34f2984b0fda4c470dfeb9c5d3f16d29785296e0cca32a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F41A531A0060CDFDB25AFE9CA8457EB7B6EF80360F248529F65997140D771DE418F90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00B02568 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B0259C
                                                                                                                                                                                        • __isleadbyte_l.LIBCMT ref: 00B025D0
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,00AF89F9,?,00000000,00000000,?,?,?,?,00AF89F9,00000000,?), ref: 00B02601
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,00AF89F9,00000001,00000000,00000000,?,?,?,?,00AF89F9,00000000,?), ref: 00B0266F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3058430110-0
                                                                                                                                                                                        • Opcode ID: 879148b5f5f57ef9c47b389c0770485594c9dda50846ccefcf15dcf6bb536d52
                                                                                                                                                                                        • Instruction ID: d45c9ce299af7986f1730fb8ae1bae63f797fbcde2e3e5ad438e70a80bd0f000
                                                                                                                                                                                        • Opcode Fuzzy Hash: 879148b5f5f57ef9c47b389c0770485594c9dda50846ccefcf15dcf6bb536d52
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E31DB31A00245EFCB20DF64CC999AE3FE0FF15310F1489A8E4618B1E1EB31D948DB50
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00B03F46 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3016257755-0
                                                                                                                                                                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                        • Instruction ID: 65177df77063014f05389fba50b826e710a4c8290e765cb4431d66a490ec9ceb
                                                                                                                                                                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9A11BC7240014ABBCF121F84CC59CEE3FBAFB18B40F198495FA1858070C736CAB1AB81
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF2D57 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF2D63
                                                                                                                                                                                          • Part of subcall function 00AF745E: __getptd_noexit.LIBCMT ref: 00AF7461
                                                                                                                                                                                          • Part of subcall function 00AF745E: __amsg_exit.LIBCMT ref: 00AF746E
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF2D7A
                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 00AF2D88
                                                                                                                                                                                        • __lock.LIBCMT ref: 00AF2D98
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3521780317-0
                                                                                                                                                                                        • Opcode ID: 5f62e5eac20db75ac9366965bf32101c1dc2ee0195fc7a1042935c37bbaa6527
                                                                                                                                                                                        • Instruction ID: f00b2435f61bef704c663aebf785da385554ba776933ae8023fcde42446329f2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f62e5eac20db75ac9366965bf32101c1dc2ee0195fc7a1042935c37bbaa6527
                                                                                                                                                                                        • Instruction Fuzzy Hash: CBF0903294431DCAD730BBE48A02BBD36A0AF00720F104269B7546B6D1CF309940CB92
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE9C50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: swprintf
                                                                                                                                                                                        • String ID: %$+
                                                                                                                                                                                        • API String ID: 233258989-2626897407
                                                                                                                                                                                        • Opcode ID: 543a444ecc8243ca05363b78144ea28cd72ef0689d89807caf7042401439f268
                                                                                                                                                                                        • Instruction ID: 8b2496c97cfefef614494e6f119d3d834c9135d020942da06400be422140ff63
                                                                                                                                                                                        • Opcode Fuzzy Hash: 543a444ecc8243ca05363b78144ea28cd72ef0689d89807caf7042401439f268
                                                                                                                                                                                        • Instruction Fuzzy Hash: CE518973A08394ABD716AF19CCC47E77BE8EB85340F204948E981932A2E7658D048BD2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE9E30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: swprintf
                                                                                                                                                                                        • String ID: %$+
                                                                                                                                                                                        • API String ID: 233258989-2626897407
                                                                                                                                                                                        • Opcode ID: 020baaa0f55108fa5616591767539198827bd7aded5dbbffc3a7c27212dc4886
                                                                                                                                                                                        • Instruction ID: 045d91c06e88b4c9f0dced81d84e642c614149bfb6bfe03f5934e742991b0a32
                                                                                                                                                                                        • Opcode Fuzzy Hash: 020baaa0f55108fa5616591767539198827bd7aded5dbbffc3a7c27212dc4886
                                                                                                                                                                                        • Instruction Fuzzy Hash: BE516972A083C09BD715DF59C884BEB7BF8EB45340F204848F992D3292E7798D448BD2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEBE50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _localeconv.LIBCMT ref: 00AEBE7E
                                                                                                                                                                                          • Part of subcall function 00AF1D24: __getptd.LIBCMT ref: 00AF1D24
                                                                                                                                                                                          • Part of subcall function 00AEE938: ____lc_handle_func.LIBCMT ref: 00AEE93B
                                                                                                                                                                                          • Part of subcall function 00AEE938: ____lc_codepage_func.LIBCMT ref: 00AEE943
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ____lc_codepage_func____lc_handle_func__getptd_localeconv
                                                                                                                                                                                        • String ID: false$true
                                                                                                                                                                                        • API String ID: 679402580-2658103896
                                                                                                                                                                                        • Opcode ID: 63233226f3822b2aa9f167b5091d9ee56d768867a93bf427148a5a324983d926
                                                                                                                                                                                        • Instruction ID: 441823cc08ea3bcd018fc5593d8dca274c5e6c6c5872d64ba2ca9d8c926c6cac
                                                                                                                                                                                        • Opcode Fuzzy Hash: 63233226f3822b2aa9f167b5091d9ee56d768867a93bf427148a5a324983d926
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B417B76D052D18FCB12DF3989586AEBBE1AF46310B1C81A4D9859F343D731D90ACBE0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AE4B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: String_base::_Xlen_memcpy_sstd::_
                                                                                                                                                                                        • String ID: &count=16&show=1&version=
                                                                                                                                                                                        • API String ID: 923394732-3206526835
                                                                                                                                                                                        • Opcode ID: 2539f880a65bff74711d035213fa6c49ba66e93a64557084a92597a0265da81c
                                                                                                                                                                                        • Instruction ID: b227e11ef377780c400e6ab05722b7df115cd9cdaeabbcdc74cd535af607583e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2539f880a65bff74711d035213fa6c49ba66e93a64557084a92597a0265da81c
                                                                                                                                                                                        • Instruction Fuzzy Hash: AF21B1313047458B8734EF6AD9C096AB3EEEFD97113204A6EE152CBA51EB71FC0587A4
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEC340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • std::exception::exception.LIBCMT ref: 00AEC38B
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AEC39A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Exception@8Throwstd::exception::exception
                                                                                                                                                                                        • String ID: count
                                                                                                                                                                                        • API String ID: 3728558374-2245608546
                                                                                                                                                                                        • Opcode ID: 64b0e8af9db7e8fef4a9ca9b67ad91c712463e62b8ef5c46201d39c5cfd65b13
                                                                                                                                                                                        • Instruction ID: fb6623d57f7d09ff89bb7ffed832574f458370a36ec2bc97005637a4b1ce6fba
                                                                                                                                                                                        • Opcode Fuzzy Hash: 64b0e8af9db7e8fef4a9ca9b67ad91c712463e62b8ef5c46201d39c5cfd65b13
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4721AF715087829FC310DF25C981A6BFBE8FB88750F408E2EF48697651E774E908CB62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AF4C88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00AF281B: __getptd.LIBCMT ref: 00AF2821
                                                                                                                                                                                          • Part of subcall function 00AF281B: __getptd.LIBCMT ref: 00AF2831
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF4C97
                                                                                                                                                                                          • Part of subcall function 00AF745E: __getptd_noexit.LIBCMT ref: 00AF7461
                                                                                                                                                                                          • Part of subcall function 00AF745E: __amsg_exit.LIBCMT ref: 00AF746E
                                                                                                                                                                                        • __getptd.LIBCMT ref: 00AF4CA5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                        • API String ID: 803148776-1018135373
                                                                                                                                                                                        • Opcode ID: 9141375e32c6e99359493de0b92c1a0b1a3df5fb56f216c9323901ab87347d38
                                                                                                                                                                                        • Instruction ID: eda8c69edd12b6abebec90f40c00012b8b80a4fedab04a3500a6f33ce7835183
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9141375e32c6e99359493de0b92c1a0b1a3df5fb56f216c9323901ab87347d38
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7601623580230D9BCF349FA4C540A7EB7B5BF18329F24642EF65256551CB358992CF91
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00AEE395 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __EH_prolog3.LIBCMT ref: 00AEE39C
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00AEE3C7
                                                                                                                                                                                          • Part of subcall function 00AF249B: KiUserExceptionDispatcher.NTDLL(?,?,00AF11EB,?,?,?,?,?,00AF11EB,?,00B0C4F0,00B11320), ref: 00AF24DD
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • invalid string position, xrefs: 00AEE3A1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000007.00000002.2455028367.0000000000AE1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00AE0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000007.00000002.2454985456.0000000000AE0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455079953.0000000000B08000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455112003.0000000000B0F000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000007.00000002.2455143492.0000000000B14000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_7_2_ae0000_360TopbarASS.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DispatcherExceptionException@8H_prolog3ThrowUser
                                                                                                                                                                                        • String ID: invalid string position
                                                                                                                                                                                        • API String ID: 2727533346-1799206989
                                                                                                                                                                                        • Opcode ID: 84c1362ebfc8319792bc5933f7bc75a1591308077fbf2555ff214ed2921afbd1
                                                                                                                                                                                        • Instruction ID: c56520094065ba90c79853af65326ca670d20bcde9ef43857fe594438911862a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 84c1362ebfc8319792bc5933f7bc75a1591308077fbf2555ff214ed2921afbd1
                                                                                                                                                                                        • Instruction Fuzzy Hash: EDD01772A5010C9ACF04F7E0CD56FED7BB8AB14311F5004A9F301B60D1DBB45604CB60
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                        Execution Coverage:7.6%
                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:58.9%
                                                                                                                                                                                        Signature Coverage:6.2%
                                                                                                                                                                                        Total number of Nodes:1700
                                                                                                                                                                                        Total number of Limit Nodes:61
                                                                                                                                                                                        execution_graph 11153 3783470 11154 3783481 _memset 11153->11154 11157 3783390 11154->11157 11156 3783490 11158 37833c8 _memset 11157->11158 11159 37833b0 11157->11159 11171 37832e0 11158->11171 11181 378579a 11159->11181 11161 37833c1 11161->11156 11163 37833ed 11163->11159 11164 3783419 LoadLibraryA 11163->11164 11165 378342b GetProcAddress 11164->11165 11166 378344d 11164->11166 11167 378343b 11165->11167 11168 3783446 FreeLibrary 11165->11168 11169 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11166->11169 11167->11168 11168->11166 11170 3783462 11169->11170 11170->11156 11172 37832fe _memset 11171->11172 11178 3783343 11171->11178 11189 3783170 11172->11189 11173 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11174 3783385 11173->11174 11174->11163 11176 3783327 11177 378332e lstrlenW 11176->11177 11176->11178 11177->11178 11179 3783347 __alloca_probe_16 11177->11179 11178->11173 11204 3782a20 11179->11204 11182 37857a2 11181->11182 11183 37857a4 IsDebuggerPresent 11181->11183 11182->11161 11208 378ba85 11183->11208 11186 3786858 SetUnhandledExceptionFilter UnhandledExceptionFilter 11187 378687d GetCurrentProcess TerminateProcess 11186->11187 11188 3786875 __invoke_watson 11186->11188 11187->11161 11188->11187 11192 378317a _memset __write_nolock 11189->11192 11190 37832a9 11191 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11190->11191 11193 37832cf 11191->11193 11192->11190 11194 37831cc SHGetValueW 11192->11194 11193->11176 11195 37831fb PathFileExistsW 11194->11195 11196 378322c GetModuleFileNameW PathRemoveFileSpecW 11194->11196 11195->11196 11198 378320a PathRemoveFileSpecW 11195->11198 11197 3783255 _wcsrchr 11196->11197 11199 3783221 _wcsrchr 11197->11199 11198->11199 11199->11199 11200 378328d ExpandEnvironmentStringsW 11199->11200 11201 3783276 11199->11201 11200->11190 11200->11201 11202 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11201->11202 11203 3783286 11202->11203 11203->11176 11205 3782a58 11204->11205 11206 3782a29 11204->11206 11205->11178 11206->11205 11207 3782a31 WideCharToMultiByte 11206->11207 11207->11178 11208->11186 12332 401f51 12333 401f63 12332->12333 12342 402004 12332->12342 12334 4029e8 18 API calls 12333->12334 12336 401f6a 12334->12336 12335 401423 25 API calls 12343 40215b 12335->12343 12337 4029e8 18 API calls 12336->12337 12338 401f73 12337->12338 12339 401f88 LoadLibraryExA 12338->12339 12340 401f7b GetModuleHandleA 12338->12340 12341 401f98 GetProcAddress 12339->12341 12339->12342 12340->12339 12340->12341 12344 401fe5 12341->12344 12345 401fa8 12341->12345 12342->12335 12346 404de1 25 API calls 12344->12346 12349 401fb8 12345->12349 12350 401423 12345->12350 12346->12349 12348 401ff8 FreeLibrary 12348->12343 12349->12343 12349->12348 12351 404de1 25 API calls 12350->12351 12352 401431 12351->12352 12352->12349 10697 402164 10698 4029e8 18 API calls 10697->10698 10699 40216a 10698->10699 10700 4029e8 18 API calls 10699->10700 10701 402173 10700->10701 10702 4029e8 18 API calls 10701->10702 10703 40217c 10702->10703 10712 405d3a FindFirstFileA 10703->10712 10706 402196 lstrlenA lstrlenA 10715 404de1 10706->10715 10707 402189 10708 404de1 25 API calls 10707->10708 10710 402191 10707->10710 10708->10710 10713 405d50 FindClose 10712->10713 10714 402185 10712->10714 10713->10714 10714->10706 10714->10707 10716 404dfc 10715->10716 10725 4021d2 SHFileOperationA 10715->10725 10717 404e19 lstrlenA 10716->10717 10720 405a65 18 API calls 10716->10720 10718 404e42 10717->10718 10719 404e27 lstrlenA 10717->10719 10722 404e55 10718->10722 10723 404e48 SetWindowTextA 10718->10723 10721 404e39 lstrcatA 10719->10721 10719->10725 10720->10717 10721->10718 10724 404e5b SendMessageA SendMessageA SendMessageA 10722->10724 10722->10725 10723->10722 10724->10725 10725->10707 10725->10710 12304 40266e 12305 4029e8 18 API calls 12304->12305 12307 40267c 12305->12307 12306 402692 12309 4056fb 2 API calls 12306->12309 12307->12306 12308 4029e8 18 API calls 12307->12308 12308->12306 12310 402698 12309->12310 12330 40571a GetFileAttributesA CreateFileA 12310->12330 12312 4026a5 12313 4026b1 GlobalAlloc 12312->12313 12314 40274e 12312->12314 12317 402745 CloseHandle 12313->12317 12318 4026ca 12313->12318 12315 402756 DeleteFileA 12314->12315 12316 402769 12314->12316 12315->12316 12317->12314 12331 4031da SetFilePointer 12318->12331 12320 4026d0 12321 4031a8 ReadFile 12320->12321 12322 4026d9 GlobalAlloc 12321->12322 12323 4026e9 12322->12323 12324 40271d WriteFile GlobalFree 12322->12324 12325 402f01 47 API calls 12323->12325 12326 402f01 47 API calls 12324->12326 12328 4026f6 12325->12328 12327 402742 12326->12327 12327->12317 12329 402714 GlobalFree 12328->12329 12329->12324 12330->12312 12331->12320 14019 40276f 14020 4029cb 18 API calls 14019->14020 14021 402775 14020->14021 14022 4027b0 14021->14022 14023 402799 14021->14023 14027 40264e 14021->14027 14025 4027c6 14022->14025 14026 4027ba 14022->14026 14024 40279e 14023->14024 14032 4027ad 14023->14032 14033 405a43 lstrcpynA 14024->14033 14029 405a65 18 API calls 14025->14029 14028 4029cb 18 API calls 14026->14028 14028->14032 14029->14032 14032->14027 14034 4059a1 wsprintfA 14032->14034 14033->14027 14034->14027 11080 401b06 11081 401b13 11080->11081 11082 401b57 11080->11082 11088 401b9b 11081->11088 11090 401b2a 11081->11090 11083 401b80 GlobalAlloc 11082->11083 11084 401b5b 11082->11084 11085 405a65 18 API calls 11083->11085 11094 402200 11084->11094 11101 405a43 lstrcpynA 11084->11101 11085->11088 11086 405a65 18 API calls 11089 4021fa 11086->11089 11088->11086 11088->11094 11089->11094 11095 405304 MessageBoxIndirectA 11089->11095 11099 405a43 lstrcpynA 11090->11099 11092 401b6d GlobalFree 11092->11094 11093 401b39 11100 405a43 lstrcpynA 11093->11100 11095->11094 11097 401b48 11102 405a43 lstrcpynA 11097->11102 11099->11093 11100->11097 11101->11092 11102->11094 12413 402215 12414 402223 12413->12414 12415 40221d 12413->12415 12417 4029e8 18 API calls 12414->12417 12418 402233 12414->12418 12416 4029e8 18 API calls 12415->12416 12416->12414 12417->12418 12420 4029e8 18 API calls 12418->12420 12422 402241 12418->12422 12419 4029e8 18 API calls 12421 40224a WritePrivateProfileStringA 12419->12421 12420->12422 12422->12419 10626 401721 10632 4029e8 10626->10632 10630 40172f 10631 405749 2 API calls 10630->10631 10631->10630 10633 4029f4 10632->10633 10642 405a65 10633->10642 10636 401728 10638 405749 10636->10638 10639 405754 GetTickCount GetTempFileNameA 10638->10639 10640 405780 10639->10640 10641 405784 10639->10641 10640->10639 10640->10641 10641->10630 10658 405a72 10642->10658 10643 405c88 10644 402a15 10643->10644 10676 405a43 lstrcpynA 10643->10676 10644->10636 10660 405ca1 10644->10660 10646 405b06 GetVersion 10646->10658 10647 405c5f lstrlenA 10647->10658 10650 405a65 10 API calls 10650->10647 10652 405b7e GetSystemDirectoryA 10652->10658 10653 405b91 GetWindowsDirectoryA 10653->10658 10654 405ca1 5 API calls 10654->10658 10655 405bc5 SHGetSpecialFolderLocation 10655->10658 10659 405bdd SHGetPathFromIDListA CoTaskMemFree 10655->10659 10656 405a65 10 API calls 10656->10658 10657 405c08 lstrcatA 10657->10658 10658->10643 10658->10646 10658->10647 10658->10650 10658->10652 10658->10653 10658->10654 10658->10655 10658->10656 10658->10657 10669 40592a RegOpenKeyExA 10658->10669 10674 4059a1 wsprintfA 10658->10674 10675 405a43 lstrcpynA 10658->10675 10659->10658 10667 405cad 10660->10667 10661 405d19 CharPrevA 10665 405d15 10661->10665 10662 405d0a CharNextA 10662->10665 10662->10667 10663 405d34 10663->10636 10665->10661 10665->10663 10666 405cf8 CharNextA 10666->10667 10667->10662 10667->10665 10667->10666 10668 405d05 CharNextA 10667->10668 10677 405561 10667->10677 10668->10662 10670 40599b 10669->10670 10671 40595d RegQueryValueExA 10669->10671 10670->10658 10672 40597e RegCloseKey 10671->10672 10672->10670 10674->10658 10675->10658 10676->10644 10678 405567 10677->10678 10679 40557a 10678->10679 10680 40556d CharNextA 10678->10680 10679->10667 10680->10678 10726 403225 #17 SetErrorMode OleInitialize 10796 405d61 GetModuleHandleA 10726->10796 10730 403293 GetCommandLineA 10801 405a43 lstrcpynA 10730->10801 10732 4032a5 GetModuleHandleA 10733 4032bc 10732->10733 10734 405561 CharNextA 10733->10734 10735 4032d0 CharNextA 10734->10735 10740 4032dd 10735->10740 10736 403346 10737 403359 GetTempPathA 10736->10737 10802 4031f1 10737->10802 10739 40336f 10741 403393 DeleteFileA 10739->10741 10742 403373 GetWindowsDirectoryA lstrcatA 10739->10742 10740->10736 10743 405561 CharNextA 10740->10743 10747 403348 10740->10747 10810 402c5b GetTickCount GetModuleFileNameA 10741->10810 10744 4031f1 11 API calls 10742->10744 10743->10740 10746 40338f 10744->10746 10746->10741 10750 403411 ExitProcess OleUninitialize 10746->10750 10895 405a43 lstrcpynA 10747->10895 10748 4033a4 10748->10750 10753 4033fd 10748->10753 10754 405561 CharNextA 10748->10754 10751 403426 10750->10751 10752 40350b 10750->10752 10912 405304 10751->10912 10756 40358e ExitProcess 10752->10756 10762 405d61 3 API calls 10752->10762 10840 4035e3 10753->10840 10759 4033bb 10754->10759 10766 4033d8 10759->10766 10767 40343c lstrcatA lstrcmpiA 10759->10767 10763 40351a 10762->10763 10764 405d61 3 API calls 10763->10764 10765 403523 10764->10765 10768 405d61 3 API calls 10765->10768 10896 405617 10766->10896 10767->10750 10769 403458 CreateDirectoryA SetCurrentDirectoryA 10767->10769 10771 40352c 10768->10771 10772 40347a 10769->10772 10773 40346f 10769->10773 10775 40357a ExitWindowsEx 10771->10775 10780 40353a GetCurrentProcess 10771->10780 10917 405a43 lstrcpynA 10772->10917 10916 405a43 lstrcpynA 10773->10916 10775->10756 10779 403587 10775->10779 10950 40140b 10779->10950 10785 40354a 10780->10785 10781 4033f2 10911 405a43 lstrcpynA 10781->10911 10784 405a65 18 API calls 10786 4034aa DeleteFileA 10784->10786 10785->10775 10787 4034b7 CopyFileA 10786->10787 10793 403488 10786->10793 10787->10793 10788 4034ff 10790 405791 39 API calls 10788->10790 10791 403506 10790->10791 10791->10750 10792 405a65 18 API calls 10792->10793 10793->10784 10793->10788 10793->10792 10795 4034eb CloseHandle 10793->10795 10918 405791 10793->10918 10947 4052a3 CreateProcessA 10793->10947 10795->10793 10797 405d88 GetProcAddress 10796->10797 10798 405d7d LoadLibraryA 10796->10798 10799 403268 SHGetFileInfoA 10797->10799 10798->10797 10798->10799 10800 405a43 lstrcpynA 10799->10800 10800->10730 10801->10732 10803 405ca1 5 API calls 10802->10803 10805 4031fd 10803->10805 10804 403207 10804->10739 10805->10804 10953 405536 lstrlenA CharPrevA 10805->10953 10808 405749 2 API calls 10809 403223 10808->10809 10809->10739 10956 40571a GetFileAttributesA CreateFileA 10810->10956 10812 402c9e 10839 402cab 10812->10839 10957 405a43 lstrcpynA 10812->10957 10814 402cc1 10958 40557d lstrlenA 10814->10958 10818 402cd2 GetFileSize 10819 402dd3 10818->10819 10837 402ce9 10818->10837 10965 402bc5 10819->10965 10823 402e16 GlobalAlloc 10827 402e2d 10823->10827 10824 402e6e 10825 402bc5 32 API calls 10824->10825 10825->10839 10829 405749 2 API calls 10827->10829 10828 402df7 10830 4031a8 ReadFile 10828->10830 10832 402e3e CreateFileA 10829->10832 10833 402e02 10830->10833 10831 402bc5 32 API calls 10831->10837 10834 402e78 10832->10834 10832->10839 10833->10823 10833->10839 10980 4031da SetFilePointer 10834->10980 10836 402e86 10981 402f01 10836->10981 10837->10819 10837->10824 10837->10831 10837->10839 10963 4031a8 ReadFile 10837->10963 10839->10748 10841 405d61 3 API calls 10840->10841 10842 4035f7 10841->10842 10843 4035fd 10842->10843 10844 40360f 10842->10844 11034 4059a1 wsprintfA 10843->11034 10845 40592a 3 API calls 10844->10845 10846 403630 10845->10846 10848 40364e lstrcatA 10846->10848 10850 40592a 3 API calls 10846->10850 10849 40360d 10848->10849 11025 403897 10849->11025 10850->10848 10853 405617 18 API calls 10854 403676 10853->10854 10855 4036ff 10854->10855 10858 40592a 3 API calls 10854->10858 10856 405617 18 API calls 10855->10856 10857 403705 10856->10857 10860 403715 LoadImageA 10857->10860 10861 405a65 18 API calls 10857->10861 10859 4036a2 10858->10859 10859->10855 10864 4036be lstrlenA 10859->10864 10868 405561 CharNextA 10859->10868 10862 403740 RegisterClassA 10860->10862 10863 4037c9 10860->10863 10861->10860 10865 40377c SystemParametersInfoA CreateWindowExA 10862->10865 10866 40340d 10862->10866 10867 40140b 2 API calls 10863->10867 10869 4036f2 10864->10869 10870 4036cc lstrcmpiA 10864->10870 10865->10863 10866->10750 10871 4037cf 10867->10871 10872 4036bc 10868->10872 10874 405536 3 API calls 10869->10874 10870->10869 10873 4036dc GetFileAttributesA 10870->10873 10871->10866 10876 403897 19 API calls 10871->10876 10872->10864 10875 4036e8 10873->10875 10877 4036f8 10874->10877 10875->10869 10878 40557d 2 API calls 10875->10878 10879 4037e0 10876->10879 11035 405a43 lstrcpynA 10877->11035 10878->10869 10881 403864 10879->10881 10882 4037e8 ShowWindow LoadLibraryA 10879->10882 11036 404eb3 OleInitialize 10881->11036 10884 403807 LoadLibraryA 10882->10884 10885 40380e GetClassInfoA 10882->10885 10884->10885 10886 403822 GetClassInfoA RegisterClassA 10885->10886 10887 403838 DialogBoxParamA 10885->10887 10886->10887 10889 40140b 2 API calls 10887->10889 10888 40386a 10890 403886 10888->10890 10891 40386e 10888->10891 10892 403860 10889->10892 10893 40140b 2 API calls 10890->10893 10891->10866 10894 40140b 2 API calls 10891->10894 10892->10866 10893->10866 10894->10866 10895->10737 11051 405a43 lstrcpynA 10896->11051 10898 405628 11052 4055ca CharNextA CharNextA 10898->11052 10901 4033e3 10901->10750 10910 405a43 lstrcpynA 10901->10910 10902 405ca1 5 API calls 10905 40563e 10902->10905 10903 405669 lstrlenA 10904 405674 10903->10904 10903->10905 10907 405536 3 API calls 10904->10907 10905->10901 10905->10903 10906 405d3a 2 API calls 10905->10906 10909 40557d 2 API calls 10905->10909 10906->10905 10908 405679 GetFileAttributesA 10907->10908 10908->10901 10909->10903 10910->10781 10911->10753 10913 405319 10912->10913 10914 403434 ExitProcess 10913->10914 10915 40532d MessageBoxIndirectA 10913->10915 10915->10914 10916->10772 10917->10793 10919 405d61 3 API calls 10918->10919 10920 40579c 10919->10920 10921 4057a4 MoveFileExA 10920->10921 10922 4057b5 10920->10922 10921->10922 10923 4058ee 10921->10923 10924 4057d3 10922->10924 10925 4057f9 GetShortPathNameA 10922->10925 10923->10793 11058 40571a GetFileAttributesA CreateFileA 10924->11058 10925->10923 10926 40580e 10925->10926 10926->10923 10928 405816 wsprintfA 10926->10928 10930 405a65 18 API calls 10928->10930 10929 4057dd CloseHandle GetShortPathNameA 10929->10923 10931 4057f1 10929->10931 10932 40583e 10930->10932 10931->10923 10931->10925 11059 40571a GetFileAttributesA CreateFileA 10932->11059 10934 40584b 10934->10923 10935 40585a GetFileSize GlobalAlloc 10934->10935 10936 4058e7 CloseHandle 10935->10936 10937 405878 ReadFile 10935->10937 10936->10923 10937->10936 10938 40588c 10937->10938 10938->10936 11060 40568f lstrlenA 10938->11060 10941 4058a1 11065 405a43 lstrcpynA 10941->11065 10942 4058fb 10943 40568f 4 API calls 10942->10943 10945 4058af 10943->10945 10946 4058c2 SetFilePointer WriteFile GlobalFree 10945->10946 10946->10936 10948 4052d2 CloseHandle 10947->10948 10949 4052de 10947->10949 10948->10949 10949->10793 10951 401389 2 API calls 10950->10951 10952 401420 10951->10952 10952->10756 10954 405550 lstrcatA 10953->10954 10955 40320f CreateDirectoryA 10953->10955 10954->10955 10955->10808 10956->10812 10957->10814 10959 40558a 10958->10959 10960 402cc7 10959->10960 10961 40558f CharPrevA 10959->10961 10962 405a43 lstrcpynA 10960->10962 10961->10959 10961->10960 10962->10818 10964 4031c9 10963->10964 10964->10837 10966 402bd3 10965->10966 10967 402beb 10965->10967 10968 402be3 10966->10968 10969 402bdc DestroyWindow 10966->10969 10970 402bf3 10967->10970 10971 402bfb GetTickCount 10967->10971 10968->10823 10968->10839 10996 4031da SetFilePointer 10968->10996 10969->10968 10997 405d9a 10970->10997 10971->10968 10973 402c09 10971->10973 10974 402c11 10973->10974 10975 402c3e CreateDialogParamA 10973->10975 10974->10968 11001 402ba9 10974->11001 10975->10968 10977 402c1f wsprintfA 10978 404de1 25 API calls 10977->10978 10979 402c3c 10978->10979 10979->10968 10980->10836 10982 402f12 SetFilePointer 10981->10982 10983 402f2e 10981->10983 10982->10983 11004 40302c GetTickCount 10983->11004 10986 402f3f ReadFile 10987 402f5f 10986->10987 10992 402feb 10986->10992 10988 40302c 42 API calls 10987->10988 10987->10992 10989 402f76 10988->10989 10990 402ff1 ReadFile 10989->10990 10989->10992 10993 402f86 10989->10993 10990->10992 10992->10839 10993->10992 10994 402fa1 ReadFile 10993->10994 10995 402fba WriteFile 10993->10995 10994->10992 10994->10993 10995->10992 10995->10993 10996->10828 10998 405db7 PeekMessageA 10997->10998 10999 405dc7 10998->10999 11000 405dad DispatchMessageA 10998->11000 10999->10968 11000->10998 11002 402bb8 11001->11002 11003 402bba MulDiv 11001->11003 11002->11003 11003->10977 11005 403196 11004->11005 11006 40305b 11004->11006 11008 402bc5 32 API calls 11005->11008 11017 4031da SetFilePointer 11006->11017 11013 402f37 11008->11013 11009 403066 SetFilePointer 11014 40308b 11009->11014 11010 4031a8 ReadFile 11010->11014 11012 402bc5 32 API calls 11012->11014 11013->10986 11013->10992 11014->11010 11014->11012 11014->11013 11015 403120 WriteFile 11014->11015 11016 403177 SetFilePointer 11014->11016 11018 405e5b 11014->11018 11015->11013 11015->11014 11016->11005 11017->11009 11019 405e80 11018->11019 11020 405e88 11018->11020 11019->11014 11020->11019 11021 405f18 GlobalAlloc 11020->11021 11022 405f0f GlobalFree 11020->11022 11023 405f86 GlobalFree 11020->11023 11024 405f8f GlobalAlloc 11020->11024 11021->11019 11021->11020 11022->11021 11023->11024 11024->11019 11024->11020 11026 4038ab 11025->11026 11043 4059a1 wsprintfA 11026->11043 11028 40391c 11029 405a65 18 API calls 11028->11029 11030 403928 SetWindowTextA 11029->11030 11031 40365e 11030->11031 11032 403944 11030->11032 11031->10853 11032->11031 11033 405a65 18 API calls 11032->11033 11033->11032 11034->10849 11035->10855 11044 403e83 11036->11044 11038 403e83 SendMessageA 11040 404f0f OleUninitialize 11038->11040 11039 404ed6 11042 404efd 11039->11042 11047 401389 11039->11047 11040->10888 11042->11038 11043->11028 11045 403e9b 11044->11045 11046 403e8c SendMessageA 11044->11046 11045->11039 11046->11045 11048 401390 11047->11048 11049 4013fe 11048->11049 11050 4013cb MulDiv SendMessageA 11048->11050 11049->11039 11050->11048 11051->10898 11053 4055e4 11052->11053 11057 4055f0 11052->11057 11054 4055eb CharNextA 11053->11054 11053->11057 11055 40560d 11054->11055 11055->10901 11055->10902 11056 405561 CharNextA 11056->11057 11057->11055 11057->11056 11058->10929 11059->10934 11061 4056c5 lstrlenA 11060->11061 11062 4056a3 lstrcmpiA 11061->11062 11063 4056cf 11061->11063 11062->11063 11064 4056bc CharNextA 11062->11064 11063->10941 11063->10942 11064->11061 11065->10945 11213 3786314 11214 378631f 11213->11214 11215 3786324 11213->11215 11227 3789fa5 11214->11227 11219 378621e 11215->11219 11218 3786332 11220 378622a __fcloseall 11219->11220 11224 37862c7 __fcloseall 11220->11224 11225 3786277 ___DllMainCRTStartup 11220->11225 11231 37860e9 11220->11231 11222 37862a7 11223 37860e9 __CRT_INIT@12 156 API calls 11222->11223 11222->11224 11223->11224 11224->11218 11225->11222 11225->11224 11226 37860e9 __CRT_INIT@12 156 API calls 11225->11226 11226->11222 11228 3789fca 11227->11228 11229 3789fd7 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 11227->11229 11228->11229 11230 3789fce 11228->11230 11229->11230 11230->11215 11232 37860f8 11231->11232 11233 3786174 11231->11233 11281 3789d26 HeapCreate 11232->11281 11234 378617a 11233->11234 11235 37861ab 11233->11235 11240 3786195 11234->11240 11246 3786103 11234->11246 11412 3789571 11234->11412 11238 3786209 11235->11238 11239 37861b0 11235->11239 11238->11246 11467 37876a9 11238->11467 11415 378738f TlsGetValue 11239->11415 11240->11246 11249 3789822 __ioterm 68 API calls 11240->11249 11246->11225 11248 378610f __RTC_Initialize 11251 3786113 11248->11251 11258 378611f GetCommandLineA 11248->11258 11252 378619f 11249->11252 11373 3789d56 11251->11373 11255 37873c3 __mtterm 70 API calls 11252->11255 11253 37861cd 11426 3787314 TlsGetValue 11253->11426 11257 37861a4 11255->11257 11260 3789d56 __heap_term 4 API calls 11257->11260 11317 3789ba3 11258->11317 11260->11246 11264 37861fd 11454 3786370 11264->11454 11265 37861e6 11436 3787400 11265->11436 11266 3786139 11269 378613d 11266->11269 11390 3789ae8 11266->11390 11379 37873c3 11269->11379 11272 37861ed GetCurrentThreadId 11272->11246 11273 3786162 11273->11246 11274 3786149 11280 378615d 11274->11280 11358 3789870 11274->11358 11280->11273 11407 3789822 11280->11407 11282 37860fe 11281->11282 11282->11246 11283 3787717 GetModuleHandleW 11282->11283 11284 378772b 11283->11284 11285 3787732 11283->11285 11478 37892bb 11284->11478 11287 378789a 11285->11287 11288 378773c GetProcAddress GetProcAddress GetProcAddress GetProcAddress 11285->11288 11291 37873c3 __mtterm 70 API calls 11287->11291 11290 3787785 TlsAlloc 11288->11290 11293 378789f 11290->11293 11294 37877d3 TlsSetValue 11290->11294 11291->11293 11293->11248 11294->11293 11295 37877e4 11294->11295 11482 3789580 11295->11482 11300 3787299 __encode_pointer 6 API calls 11301 3787804 11300->11301 11302 3787299 __encode_pointer 6 API calls 11301->11302 11303 3787814 11302->11303 11304 3787299 __encode_pointer 6 API calls 11303->11304 11305 3787824 11304->11305 11499 378a198 11305->11499 11308 3787314 __decode_pointer 6 API calls 11309 3787845 11308->11309 11309->11287 11310 3789221 __calloc_crt 67 API calls 11309->11310 11311 378785e 11310->11311 11311->11287 11312 3787314 __decode_pointer 6 API calls 11311->11312 11313 3787878 11312->11313 11313->11287 11314 378787f 11313->11314 11315 3787400 __getptd_noexit 67 API calls 11314->11315 11316 3787887 GetCurrentThreadId 11315->11316 11316->11293 11318 3789be0 11317->11318 11319 3789bc1 GetEnvironmentStringsW 11317->11319 11320 3789bc9 11318->11320 11321 3789c79 11318->11321 11319->11320 11322 3789bd5 GetLastError 11319->11322 11323 3789c0b WideCharToMultiByte 11320->11323 11324 3789bfc GetEnvironmentStringsW 11320->11324 11325 3789c82 GetEnvironmentStrings 11321->11325 11326 378612f 11321->11326 11322->11318 11330 3789c6e FreeEnvironmentStringsW 11323->11330 11331 3789c3f 11323->11331 11324->11323 11324->11326 11325->11326 11327 3789c92 11325->11327 11343 37895ce 11326->11343 11332 37891dc __malloc_crt 67 API calls 11327->11332 11330->11326 11514 37891dc 11331->11514 11334 3789cac 11332->11334 11336 3789cbf ___crtGetEnvironmentStringsA 11334->11336 11337 3789cb3 FreeEnvironmentStringsA 11334->11337 11341 3789cc9 FreeEnvironmentStringsA 11336->11341 11337->11326 11338 3789c4d WideCharToMultiByte 11339 3789c67 11338->11339 11340 3789c5f 11338->11340 11339->11330 11342 3786370 __fcloseall 67 API calls 11340->11342 11341->11326 11342->11339 11750 3789f4c 11343->11750 11345 37895da GetStartupInfoA 11346 3789221 __calloc_crt 67 API calls 11345->11346 11352 37895fb 11346->11352 11347 3789819 __fcloseall 11347->11266 11348 3789760 11348->11347 11349 3789796 GetStdHandle 11348->11349 11351 37897fb SetHandleCount 11348->11351 11353 37897a8 GetFileType 11348->11353 11354 378d424 __mtinitlocknum InitializeCriticalSectionAndSpinCount 11348->11354 11349->11348 11350 3789221 __calloc_crt 67 API calls 11350->11352 11351->11347 11352->11347 11352->11348 11352->11350 11357 37896e3 11352->11357 11353->11348 11354->11348 11355 378970c GetFileType 11355->11357 11356 378d424 __mtinitlocknum InitializeCriticalSectionAndSpinCount 11356->11357 11357->11347 11357->11348 11357->11355 11357->11356 11359 3789879 11358->11359 11363 378987e _strlen 11358->11363 11751 3786f56 11359->11751 11361 3786152 11361->11280 11401 37893aa 11361->11401 11362 3789221 __calloc_crt 67 API calls 11364 37898b3 _strlen 11362->11364 11363->11361 11363->11362 11364->11361 11365 3789911 11364->11365 11367 3789221 __calloc_crt 67 API calls 11364->11367 11368 3789937 11364->11368 11370 37878a4 _strcpy_s 67 API calls 11364->11370 11371 37898f8 11364->11371 11366 3786370 __fcloseall 67 API calls 11365->11366 11366->11361 11367->11364 11369 3786370 __fcloseall 67 API calls 11368->11369 11369->11361 11370->11364 11371->11364 11372 37865b2 __invoke_watson 10 API calls 11371->11372 11372->11371 11374 3789db6 HeapDestroy 11373->11374 11375 3789d5f 11373->11375 11374->11246 11376 3789da4 HeapFree 11375->11376 11377 3789d7b VirtualFree HeapFree 11375->11377 11376->11374 11377->11377 11378 3789da3 11377->11378 11378->11376 11380 37873cd 11379->11380 11381 37873d9 11379->11381 11382 3787314 __decode_pointer 6 API calls 11380->11382 11383 37873ed TlsFree 11381->11383 11384 37873fb 11381->11384 11382->11381 11383->11384 11385 378a1ff DeleteCriticalSection 11384->11385 11386 378a217 11384->11386 11387 3786370 __fcloseall 67 API calls 11385->11387 11388 378a229 DeleteCriticalSection 11386->11388 11389 378a237 11386->11389 11387->11384 11388->11386 11389->11251 11391 3789afd 11390->11391 11392 3789b02 GetModuleFileNameA 11390->11392 11393 3786f56 ___initmbctable 111 API calls 11391->11393 11394 3789b29 11392->11394 11393->11392 12049 378994e 11394->12049 11397 37891dc __malloc_crt 67 API calls 11398 3789b6b 11397->11398 11399 378994e _parse_cmdline 77 API calls 11398->11399 11400 3789b85 11398->11400 11399->11400 11400->11274 11402 37893b8 __IsNonwritableInCurrentImage 11401->11402 12061 378b8e4 11402->12061 11404 37893d6 __initterm_e 11406 37893f5 __IsNonwritableInCurrentImage __initterm 11404->11406 12065 37883f0 11404->12065 11406->11280 11409 378982b 11407->11409 11408 3786172 11408->11269 11409->11408 11410 3786370 __fcloseall 67 API calls 11409->11410 11411 378983f DeleteCriticalSection 11409->11411 11410->11409 11411->11409 12165 378942f 11412->12165 11414 378957c 11414->11240 11416 37861b5 11415->11416 11417 37873a4 11415->11417 11420 3789221 11416->11420 11418 3787314 __decode_pointer 6 API calls 11417->11418 11419 37873af TlsSetValue 11418->11419 11419->11416 11422 378922a 11420->11422 11423 37861c1 11422->11423 11424 3789248 Sleep 11422->11424 12188 378ceac 11422->12188 11423->11246 11423->11253 11425 378925d 11424->11425 11425->11422 11425->11423 11427 378732c 11426->11427 11428 378734d GetModuleHandleW 11426->11428 11427->11428 11429 3787336 TlsGetValue 11427->11429 11430 3787368 GetProcAddress 11428->11430 11431 378735d 11428->11431 11434 3787341 11429->11434 11435 37861df 11430->11435 11432 37892bb __crt_waiting_on_module_handle 2 API calls 11431->11432 11433 3787363 11432->11433 11433->11430 11433->11435 11434->11428 11434->11435 11435->11264 11435->11265 12205 3789f4c 11436->12205 11438 378740c GetModuleHandleW 11439 378741c 11438->11439 11440 3787422 11438->11440 11441 37892bb __crt_waiting_on_module_handle 2 API calls 11439->11441 11442 378743a GetProcAddress GetProcAddress 11440->11442 11443 378745e 11440->11443 11441->11440 11442->11443 11444 378a314 __lock 63 API calls 11443->11444 11445 378747d InterlockedIncrement 11444->11445 12206 37874d5 11445->12206 11448 378a314 __lock 63 API calls 11449 378749e 11448->11449 11450 37870bd ___addlocaleref 8 API calls 11449->11450 11451 37874bc 11450->11451 12209 37874de 11451->12209 11453 37874c9 __fcloseall 11453->11272 11455 378637c __fcloseall 11454->11455 11456 37863bb 11455->11456 11458 378a314 __lock 65 API calls 11455->11458 11464 37863f5 __fcloseall __dosmaperr 11455->11464 11457 37863d0 HeapFree 11456->11457 11456->11464 11459 37863e2 11457->11459 11457->11464 11463 3786393 ___sbh_find_block 11458->11463 11460 3786742 _malloc 65 API calls 11459->11460 11461 37863e7 GetLastError 11460->11461 11461->11464 11462 37863ad 12221 37863c6 11462->12221 11463->11462 12214 378a377 11463->12214 11464->11273 11468 3787702 11467->11468 11469 37876b7 11467->11469 11470 378770c TlsSetValue 11468->11470 11471 3787715 11468->11471 11472 37876bd TlsGetValue 11469->11472 11476 37876e0 11469->11476 11470->11471 11471->11246 11474 37876d0 TlsGetValue 11472->11474 11472->11476 11473 3787314 __decode_pointer 6 API calls 11475 37876f7 11473->11475 11474->11476 12229 378757a 11475->12229 11476->11473 11479 37892c6 Sleep GetModuleHandleW 11478->11479 11480 3787731 11479->11480 11481 37892e4 11479->11481 11480->11285 11481->11479 11481->11480 11503 378730b 11482->11503 11484 3789588 __init_pointers __initp_misc_winsig 11506 378917b 11484->11506 11487 3787299 __encode_pointer 6 API calls 11488 37877e9 11487->11488 11489 3787299 TlsGetValue 11488->11489 11490 37872b1 11489->11490 11491 37872d2 GetModuleHandleW 11489->11491 11490->11491 11492 37872bb TlsGetValue 11490->11492 11493 37872ed GetProcAddress 11491->11493 11494 37872e2 11491->11494 11496 37872c6 11492->11496 11498 37872ca 11493->11498 11495 37892bb __crt_waiting_on_module_handle 2 API calls 11494->11495 11497 37872e8 11495->11497 11496->11491 11496->11498 11497->11493 11497->11498 11498->11300 11500 378a1a3 11499->11500 11502 3787831 11500->11502 11509 378d424 11500->11509 11502->11287 11502->11308 11504 3787299 __encode_pointer 6 API calls 11503->11504 11505 3787312 11504->11505 11505->11484 11507 3787299 __encode_pointer 6 API calls 11506->11507 11508 3789185 11507->11508 11508->11487 11513 3789f4c 11509->11513 11511 378d430 InitializeCriticalSectionAndSpinCount 11512 378d474 __fcloseall 11511->11512 11512->11500 11513->11511 11517 37891e5 11514->11517 11516 378921b 11516->11330 11516->11338 11517->11516 11518 37891fc Sleep 11517->11518 11519 378795b 11517->11519 11518->11517 11520 3787a0e 11519->11520 11529 378796d 11519->11529 11521 3788416 _malloc 6 API calls 11520->11521 11522 3787a14 11521->11522 11523 3786742 _malloc 66 API calls 11522->11523 11535 3787a06 11523->11535 11527 37879ca HeapAlloc 11527->11529 11529->11527 11530 37879fa 11529->11530 11533 37879ff 11529->11533 11529->11535 11536 378c5cb 11529->11536 11545 378c420 11529->11545 11579 378933f 11529->11579 11582 378790c 11529->11582 11590 3788416 11529->11590 11593 3786742 11530->11593 11534 3786742 _malloc 66 API calls 11533->11534 11534->11535 11535->11517 11596 378ddcd 11536->11596 11539 378ddcd __set_error_mode 67 API calls 11541 378c5df 11539->11541 11540 378c420 __NMSG_WRITE 67 API calls 11542 378c5f7 11540->11542 11541->11540 11543 378c601 11541->11543 11544 378c420 __NMSG_WRITE 67 API calls 11542->11544 11543->11529 11544->11543 11546 378c434 11545->11546 11547 378ddcd __set_error_mode 64 API calls 11546->11547 11578 378c58f 11546->11578 11548 378c456 11547->11548 11549 378c594 GetStdHandle 11548->11549 11551 378ddcd __set_error_mode 64 API calls 11548->11551 11550 378c5a2 _strlen 11549->11550 11549->11578 11554 378c5bb WriteFile 11550->11554 11550->11578 11552 378c467 11551->11552 11552->11549 11553 378c479 11552->11553 11553->11578 11605 37878a4 11553->11605 11554->11578 11557 378c4af GetModuleFileNameA 11559 378c4cd 11557->11559 11563 378c4f0 _strlen 11557->11563 11561 37878a4 _strcpy_s 64 API calls 11559->11561 11562 378c4dd 11561->11562 11562->11563 11565 37865b2 __invoke_watson 10 API calls 11562->11565 11564 378c533 11563->11564 11621 378bfb6 11563->11621 11630 378bef1 11564->11630 11565->11563 11570 378c557 11572 378bef1 _strcat_s 64 API calls 11570->11572 11571 37865b2 __invoke_watson 10 API calls 11571->11570 11573 378c56b 11572->11573 11575 378c57c 11573->11575 11576 37865b2 __invoke_watson 10 API calls 11573->11576 11574 37865b2 __invoke_watson 10 API calls 11574->11564 11639 378dc64 11575->11639 11576->11575 11578->11529 11668 3789314 GetModuleHandleW 11579->11668 11583 3787918 __fcloseall 11582->11583 11584 3787949 __fcloseall 11583->11584 11671 378a314 11583->11671 11584->11529 11586 378792e 11678 378ab26 11586->11678 11591 3787314 __decode_pointer 6 API calls 11590->11591 11592 3788426 11591->11592 11592->11529 11736 37874e7 GetLastError 11593->11736 11595 3786747 11595->11533 11598 378dddc 11596->11598 11597 378c5d2 11597->11539 11597->11541 11598->11597 11599 3786742 _malloc 67 API calls 11598->11599 11600 378ddff 11599->11600 11602 37866da 11600->11602 11603 3787314 __decode_pointer 6 API calls 11602->11603 11604 37866ea __invoke_watson 11603->11604 11606 37878bc 11605->11606 11607 37878b5 11605->11607 11608 3786742 _malloc 67 API calls 11606->11608 11607->11606 11612 37878e2 11607->11612 11609 37878c1 11608->11609 11610 37866da __close 6 API calls 11609->11610 11611 37878d0 11610->11611 11611->11557 11614 37865b2 11611->11614 11612->11611 11613 3786742 _malloc 67 API calls 11612->11613 11613->11609 11666 3785720 11614->11666 11616 37865df IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 11617 37866bb GetCurrentProcess TerminateProcess 11616->11617 11618 37866af __invoke_watson 11616->11618 11619 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11617->11619 11618->11617 11620 37866d8 11619->11620 11620->11557 11626 378bfc8 11621->11626 11622 378bfcc 11623 3786742 _malloc 67 API calls 11622->11623 11624 378bfd1 11622->11624 11625 378bfe8 11623->11625 11624->11564 11624->11574 11627 37866da __close 6 API calls 11625->11627 11626->11622 11626->11624 11628 378c012 11626->11628 11627->11624 11628->11624 11629 3786742 _malloc 67 API calls 11628->11629 11629->11625 11633 378bf09 11630->11633 11634 378bf02 11630->11634 11631 3786742 _malloc 67 API calls 11632 378bf0e 11631->11632 11635 37866da __close 6 API calls 11632->11635 11633->11631 11634->11633 11637 378bf3d 11634->11637 11636 378bf1d 11635->11636 11636->11570 11636->11571 11637->11636 11638 3786742 _malloc 67 API calls 11637->11638 11638->11632 11640 378730b ___crtMessageBoxW 6 API calls 11639->11640 11641 378dc74 11640->11641 11642 378dc87 LoadLibraryA 11641->11642 11644 378dd0f 11641->11644 11643 378dc9c GetProcAddress 11642->11643 11655 378ddb1 11642->11655 11645 378dcb2 11643->11645 11643->11655 11648 3787314 __decode_pointer 6 API calls 11644->11648 11661 378dd39 11644->11661 11649 3787299 __encode_pointer 6 API calls 11645->11649 11646 3787314 __decode_pointer 6 API calls 11646->11655 11647 3787314 __decode_pointer 6 API calls 11656 378dd7c 11647->11656 11650 378dd2c 11648->11650 11651 378dcb8 GetProcAddress 11649->11651 11652 3787314 __decode_pointer 6 API calls 11650->11652 11653 3787299 __encode_pointer 6 API calls 11651->11653 11652->11661 11654 378dccd GetProcAddress 11653->11654 11657 3787299 __encode_pointer 6 API calls 11654->11657 11655->11578 11660 3787314 __decode_pointer 6 API calls 11656->11660 11663 378dd64 11656->11663 11658 378dce2 GetProcAddress 11657->11658 11659 3787299 __encode_pointer 6 API calls 11658->11659 11662 378dcf7 11659->11662 11660->11663 11661->11647 11661->11663 11662->11644 11664 378dd01 GetProcAddress 11662->11664 11663->11646 11665 3787299 __encode_pointer 6 API calls 11664->11665 11665->11644 11667 378572c __VEC_memzero 11666->11667 11667->11616 11669 3789328 GetProcAddress 11668->11669 11670 3789338 ExitProcess 11668->11670 11669->11670 11672 378a329 11671->11672 11673 378a33c EnterCriticalSection 11671->11673 11687 378a251 11672->11687 11673->11586 11675 378a32f 11675->11673 11713 37892eb 11675->11713 11680 378ab54 11678->11680 11679 378abed 11683 3787939 11679->11683 11731 378a73d 11679->11731 11680->11679 11680->11683 11724 378a68d 11680->11724 11684 3787952 11683->11684 11735 378a23a LeaveCriticalSection 11684->11735 11686 3787959 11686->11584 11688 378a25d __fcloseall 11687->11688 11689 378a283 11688->11689 11690 378c5cb __FF_MSGBANNER 67 API calls 11688->11690 11692 37891dc __malloc_crt 67 API calls 11689->11692 11695 378a293 __fcloseall 11689->11695 11691 378a272 11690->11691 11693 378c420 __NMSG_WRITE 67 API calls 11691->11693 11694 378a29e 11692->11694 11696 378a279 11693->11696 11697 378a2b4 11694->11697 11698 378a2a5 11694->11698 11695->11675 11701 378933f _malloc 3 API calls 11696->11701 11700 378a314 __lock 67 API calls 11697->11700 11699 3786742 _malloc 67 API calls 11698->11699 11699->11695 11702 378a2bb 11700->11702 11701->11689 11703 378a2ef 11702->11703 11704 378a2c3 11702->11704 11706 3786370 __fcloseall 67 API calls 11703->11706 11705 378d424 __mtinitlocknum InitializeCriticalSectionAndSpinCount 11704->11705 11708 378a2ce 11705->11708 11707 378a2e0 11706->11707 11720 378a30b 11707->11720 11708->11707 11710 3786370 __fcloseall 67 API calls 11708->11710 11711 378a2da 11710->11711 11712 3786742 _malloc 67 API calls 11711->11712 11712->11707 11714 378c5cb __FF_MSGBANNER 67 API calls 11713->11714 11715 37892f5 11714->11715 11716 378c420 __NMSG_WRITE 67 API calls 11715->11716 11717 37892fd 11716->11717 11718 3787314 __decode_pointer 6 API calls 11717->11718 11719 3789308 11718->11719 11719->11673 11723 378a23a LeaveCriticalSection 11720->11723 11722 378a312 11722->11695 11723->11722 11725 378a6a0 HeapReAlloc 11724->11725 11726 378a6d4 HeapAlloc 11724->11726 11727 378a6c2 11725->11727 11730 378a6be 11725->11730 11728 378a6f7 VirtualAlloc 11726->11728 11726->11730 11727->11726 11729 378a711 HeapFree 11728->11729 11728->11730 11729->11730 11730->11679 11732 378a754 VirtualAlloc 11731->11732 11734 378a79b 11732->11734 11734->11683 11735->11686 11737 378738f ___set_flsgetvalue 8 API calls 11736->11737 11738 37874fe 11737->11738 11739 3787554 SetLastError 11738->11739 11740 3789221 __calloc_crt 64 API calls 11738->11740 11739->11595 11741 3787512 11740->11741 11741->11739 11742 3787314 __decode_pointer 6 API calls 11741->11742 11743 378752c 11742->11743 11744 378754b 11743->11744 11745 3787533 11743->11745 11746 3786370 __fcloseall 64 API calls 11744->11746 11747 3787400 __getptd_noexit 64 API calls 11745->11747 11748 3787551 11746->11748 11749 378753b GetCurrentThreadId 11747->11749 11748->11739 11749->11739 11750->11345 11752 3786f5f 11751->11752 11753 3786f66 11751->11753 11755 3786dbc 11752->11755 11753->11363 11756 3786dc8 __fcloseall 11755->11756 11786 3787560 11756->11786 11760 3786ddb 11807 3786b5b 11760->11807 11763 37891dc __malloc_crt 67 API calls 11764 3786dfc 11763->11764 11765 3786f1b __fcloseall 11764->11765 11814 3786bd7 11764->11814 11765->11753 11768 3786f28 11768->11765 11775 3786370 __fcloseall 67 API calls 11768->11775 11778 3786f3b 11768->11778 11769 3786e2c InterlockedDecrement 11770 3786e3c 11769->11770 11771 3786e4d InterlockedIncrement 11769->11771 11770->11771 11774 3786370 __fcloseall 67 API calls 11770->11774 11771->11765 11772 3786e63 11771->11772 11772->11765 11777 378a314 __lock 67 API calls 11772->11777 11773 3786742 _malloc 67 API calls 11773->11765 11776 3786e4c 11774->11776 11775->11778 11776->11771 11780 3786e77 InterlockedDecrement 11777->11780 11778->11773 11781 3786ef3 11780->11781 11782 3786f06 InterlockedIncrement 11780->11782 11781->11782 11784 3786370 __fcloseall 67 API calls 11781->11784 11824 3786f1d 11782->11824 11785 3786f05 11784->11785 11785->11782 11787 37874e7 __getptd_noexit 67 API calls 11786->11787 11788 3787568 11787->11788 11789 3786dd1 11788->11789 11790 37892eb __amsg_exit 67 API calls 11788->11790 11791 3786ab7 11789->11791 11790->11789 11792 3786ac3 __fcloseall 11791->11792 11793 3787560 __getptd 67 API calls 11792->11793 11794 3786ac8 11793->11794 11795 378a314 __lock 67 API calls 11794->11795 11804 3786ada 11794->11804 11796 3786af8 11795->11796 11797 3786b41 11796->11797 11799 3786b29 InterlockedIncrement 11796->11799 11800 3786b0f InterlockedDecrement 11796->11800 11827 3786b52 11797->11827 11798 3786ae8 __fcloseall 11798->11760 11799->11797 11800->11799 11803 3786b1a 11800->11803 11802 37892eb __amsg_exit 67 API calls 11802->11798 11803->11799 11805 3786370 __fcloseall 67 API calls 11803->11805 11804->11798 11804->11802 11806 3786b28 11805->11806 11806->11799 11831 378582b 11807->11831 11810 3786b98 11812 3786b9d GetACP 11810->11812 11813 3786b8a 11810->11813 11811 3786b7a GetOEMCP 11811->11813 11812->11813 11813->11763 11813->11765 11815 3786b5b getSystemCP 79 API calls 11814->11815 11816 3786bf7 11815->11816 11817 3786c02 setSBCS 11816->11817 11819 3786c46 IsValidCodePage 11816->11819 11823 3786c6b _memset __setmbcp_nolock 11816->11823 11818 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11817->11818 11820 3786dba 11818->11820 11819->11817 11821 3786c58 GetCPInfo 11819->11821 11820->11768 11820->11769 11821->11817 11821->11823 11922 3786924 GetCPInfo 11823->11922 12048 378a23a LeaveCriticalSection 11824->12048 11826 3786f24 11826->11765 11830 378a23a LeaveCriticalSection 11827->11830 11829 3786b59 11829->11804 11830->11829 11832 378583e 11831->11832 11836 378588b 11831->11836 11833 3787560 __getptd 67 API calls 11832->11833 11834 3785843 11833->11834 11835 378586b 11834->11835 11839 3787223 11834->11839 11835->11836 11838 3786ab7 _LocaleUpdate::_LocaleUpdate 69 API calls 11835->11838 11836->11810 11836->11811 11838->11836 11840 378722f __fcloseall 11839->11840 11841 3787560 __getptd 67 API calls 11840->11841 11842 3787234 11841->11842 11843 3787262 11842->11843 11844 3787246 11842->11844 11845 378a314 __lock 67 API calls 11843->11845 11846 3787560 __getptd 67 API calls 11844->11846 11847 3787269 11845->11847 11851 378724b 11846->11851 11854 37871e5 11847->11854 11852 37892eb __amsg_exit 67 API calls 11851->11852 11853 3787259 __fcloseall 11851->11853 11852->11853 11853->11835 11855 37871e9 11854->11855 11856 378721b 11854->11856 11855->11856 11865 37870bd InterlockedIncrement 11855->11865 11862 378728d 11856->11862 11858 37871fc 11858->11856 11877 378714c 11858->11877 11921 378a23a LeaveCriticalSection 11862->11921 11864 3787294 11864->11851 11866 37870db InterlockedIncrement 11865->11866 11867 37870de 11865->11867 11866->11867 11868 37870e8 InterlockedIncrement 11867->11868 11869 37870eb 11867->11869 11868->11869 11870 37870f8 11869->11870 11871 37870f5 InterlockedIncrement 11869->11871 11872 3787102 InterlockedIncrement 11870->11872 11873 3787105 11870->11873 11871->11870 11872->11873 11874 378711e InterlockedIncrement 11873->11874 11875 378712e InterlockedIncrement 11873->11875 11876 3787139 InterlockedIncrement 11873->11876 11874->11873 11875->11873 11876->11858 11878 378715d InterlockedDecrement 11877->11878 11879 37871e0 11877->11879 11880 3787172 InterlockedDecrement 11878->11880 11881 3787175 11878->11881 11879->11856 11891 3786f74 11879->11891 11880->11881 11882 378717f InterlockedDecrement 11881->11882 11883 3787182 11881->11883 11882->11883 11884 378718c InterlockedDecrement 11883->11884 11885 378718f 11883->11885 11884->11885 11886 3787199 InterlockedDecrement 11885->11886 11887 378719c 11885->11887 11886->11887 11888 37871b5 InterlockedDecrement 11887->11888 11889 37871c5 InterlockedDecrement 11887->11889 11890 37871d0 InterlockedDecrement 11887->11890 11888->11887 11889->11887 11890->11879 11892 3786ff8 11891->11892 11893 3786f8b 11891->11893 11894 3787045 11892->11894 11895 3786370 __fcloseall 67 API calls 11892->11895 11893->11892 11900 3786fbf 11893->11900 11904 3786370 __fcloseall 67 API calls 11893->11904 11896 378bc89 ___free_lc_time 67 API calls 11894->11896 11911 378706c 11894->11911 11897 3787019 11895->11897 11899 3787065 11896->11899 11898 3786370 __fcloseall 67 API calls 11897->11898 11901 378702c 11898->11901 11905 3786370 __fcloseall 67 API calls 11899->11905 11906 3786370 __fcloseall 67 API calls 11900->11906 11920 3786fe0 11900->11920 11907 3786370 __fcloseall 67 API calls 11901->11907 11902 3786370 __fcloseall 67 API calls 11908 3786fed 11902->11908 11903 37870b1 11909 3786370 __fcloseall 67 API calls 11903->11909 11910 3786fb4 11904->11910 11905->11911 11912 3786fd5 11906->11912 11913 378703a 11907->11913 11915 3786370 __fcloseall 67 API calls 11908->11915 11916 37870b7 11909->11916 11917 378be63 ___free_lconv_mon 67 API calls 11910->11917 11911->11903 11914 3786370 67 API calls __fcloseall 11911->11914 11918 378be1e ___free_lconv_num 67 API calls 11912->11918 11919 3786370 __fcloseall 67 API calls 11913->11919 11914->11911 11915->11892 11916->11856 11917->11900 11918->11920 11919->11894 11920->11902 11921->11864 11924 3786958 _memset 11922->11924 11931 3786a0a 11922->11931 11932 378bc47 11924->11932 11927 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11929 3786ab5 11927->11929 11929->11823 11930 3787dca ___crtLCMapStringA 102 API calls 11930->11931 11931->11927 11933 378582b _LocaleUpdate::_LocaleUpdate 77 API calls 11932->11933 11934 378bc5a 11933->11934 11942 378ba8d 11934->11942 11937 3787dca 11938 378582b _LocaleUpdate::_LocaleUpdate 77 API calls 11937->11938 11939 3787ddd 11938->11939 12001 3787a25 11939->12001 11943 378bad9 11942->11943 11944 378baae GetStringTypeW 11942->11944 11946 378bac6 11943->11946 11947 378bbc0 11943->11947 11945 378bace GetLastError 11944->11945 11944->11946 11945->11943 11948 378bb12 MultiByteToWideChar 11946->11948 11956 378bbba 11946->11956 11970 378c604 GetLocaleInfoA 11947->11970 11950 378bb3f 11948->11950 11948->11956 11957 378795b _malloc 67 API calls 11950->11957 11965 378bb54 _memset __alloca_probe_16 11950->11965 11951 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11952 37869c5 11951->11952 11952->11937 11954 378bc11 GetStringTypeA 11955 378bc2c 11954->11955 11954->11956 11960 3786370 __fcloseall 67 API calls 11955->11960 11956->11951 11957->11965 11959 378bb8d MultiByteToWideChar 11962 378bba3 GetStringTypeW 11959->11962 11963 378bbb4 11959->11963 11960->11956 11962->11963 11966 378580b 11963->11966 11965->11956 11965->11959 11967 3785828 11966->11967 11968 3785817 11966->11968 11967->11956 11968->11967 11969 3786370 __fcloseall 67 API calls 11968->11969 11969->11967 11971 378c637 11970->11971 11972 378c632 11970->11972 11973 378dc4e ___ansicp 90 API calls 11971->11973 11974 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11972->11974 11973->11972 11975 378bbe4 11974->11975 11975->11954 11975->11956 11976 378c64d 11975->11976 11977 378c68d GetCPInfo 11976->11977 11981 378c717 11976->11981 11978 378c702 MultiByteToWideChar 11977->11978 11979 378c6a4 11977->11979 11978->11981 11983 378c6bd _strlen 11978->11983 11979->11978 11982 378c6aa GetCPInfo 11979->11982 11980 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11984 378bc05 11980->11984 11981->11980 11982->11978 11985 378c6b7 11982->11985 11986 378c6ef _memset __alloca_probe_16 11983->11986 11987 378795b _malloc 67 API calls 11983->11987 11984->11954 11984->11956 11985->11978 11985->11983 11986->11981 11988 378c74c MultiByteToWideChar 11986->11988 11987->11986 11989 378c783 11988->11989 11990 378c764 11988->11990 11991 378580b __freea 67 API calls 11989->11991 11992 378c788 11990->11992 11993 378c76b WideCharToMultiByte 11990->11993 11991->11981 11994 378c793 WideCharToMultiByte 11992->11994 11995 378c7a7 11992->11995 11993->11989 11994->11989 11994->11995 11996 3789221 __calloc_crt 67 API calls 11995->11996 11997 378c7af 11996->11997 11997->11989 11998 378c7b8 WideCharToMultiByte 11997->11998 11998->11989 11999 378c7ca 11998->11999 12000 3786370 __fcloseall 67 API calls 11999->12000 12000->11989 12002 3787a46 LCMapStringW 12001->12002 12005 3787a61 12001->12005 12003 3787a69 GetLastError 12002->12003 12002->12005 12003->12005 12004 3787c5f 12009 378c604 ___ansicp 91 API calls 12004->12009 12005->12004 12006 3787abb 12005->12006 12007 3787c56 12006->12007 12008 3787ad4 MultiByteToWideChar 12006->12008 12011 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12007->12011 12008->12007 12017 3787b01 12008->12017 12010 3787c87 12009->12010 12010->12007 12013 3787d7b LCMapStringA 12010->12013 12014 3787ca0 12010->12014 12012 37869e5 12011->12012 12012->11930 12047 3787cd7 12013->12047 12015 378c64d ___convertcp 74 API calls 12014->12015 12020 3787cb2 12015->12020 12016 3787b52 MultiByteToWideChar 12021 3787b6b LCMapStringW 12016->12021 12042 3787c4d 12016->12042 12019 378795b _malloc 67 API calls 12017->12019 12026 3787b1a __alloca_probe_16 12017->12026 12018 3787da2 12018->12007 12028 3786370 __fcloseall 67 API calls 12018->12028 12019->12026 12020->12007 12023 3787cbc LCMapStringA 12020->12023 12025 3787b8c 12021->12025 12021->12042 12022 3786370 __fcloseall 67 API calls 12022->12018 12031 3787cde 12023->12031 12023->12047 12024 378580b __freea 67 API calls 12024->12007 12027 3787b95 12025->12027 12030 3787bbe 12025->12030 12026->12007 12026->12016 12029 3787ba7 LCMapStringW 12027->12029 12027->12042 12028->12007 12029->12042 12032 3787bd9 __alloca_probe_16 12030->12032 12038 378795b _malloc 67 API calls 12030->12038 12033 3787cef _memset __alloca_probe_16 12031->12033 12035 378795b _malloc 67 API calls 12031->12035 12034 3787c0d LCMapStringW 12032->12034 12032->12042 12040 3787d2d LCMapStringA 12033->12040 12033->12047 12036 3787c25 WideCharToMultiByte 12034->12036 12037 3787c47 12034->12037 12035->12033 12036->12037 12039 378580b __freea 67 API calls 12037->12039 12038->12032 12039->12042 12043 3787d49 12040->12043 12044 3787d4d 12040->12044 12042->12024 12046 378580b __freea 67 API calls 12043->12046 12045 378c64d ___convertcp 74 API calls 12044->12045 12045->12043 12046->12047 12047->12018 12047->12022 12048->11826 12051 378996d 12049->12051 12053 37899da 12051->12053 12055 378d4d7 12051->12055 12052 3789ad8 12052->11397 12052->11400 12053->12052 12054 378d4d7 77 API calls _parse_cmdline 12053->12054 12054->12053 12058 378d484 12055->12058 12059 378582b _LocaleUpdate::_LocaleUpdate 77 API calls 12058->12059 12060 378d497 12059->12060 12060->12051 12062 378b8ea 12061->12062 12063 3787299 __encode_pointer 6 API calls 12062->12063 12064 378b902 12062->12064 12063->12062 12064->11404 12068 37883b4 12065->12068 12067 37883fd 12067->11406 12069 37883c0 __fcloseall 12068->12069 12076 3789357 12069->12076 12075 37883e1 __fcloseall 12075->12067 12077 378a314 __lock 67 API calls 12076->12077 12078 37883c5 12077->12078 12079 37882c9 12078->12079 12080 3787314 __decode_pointer 6 API calls 12079->12080 12081 37882dd 12080->12081 12082 3787314 __decode_pointer 6 API calls 12081->12082 12083 37882ed 12082->12083 12092 3788370 12083->12092 12099 378c93b 12083->12099 12085 3788357 12086 3787299 __encode_pointer 6 API calls 12085->12086 12087 3788365 12086->12087 12090 3787299 __encode_pointer 6 API calls 12087->12090 12088 378832f 12088->12092 12093 378926d __realloc_crt 73 API calls 12088->12093 12094 3788345 12088->12094 12089 378830b 12089->12085 12089->12088 12112 378926d 12089->12112 12090->12092 12096 37883ea 12092->12096 12093->12094 12094->12092 12095 3787299 __encode_pointer 6 API calls 12094->12095 12095->12085 12161 3789360 12096->12161 12100 378c947 __fcloseall 12099->12100 12101 378c974 12100->12101 12102 378c957 12100->12102 12103 378c9b5 HeapSize 12101->12103 12105 378a314 __lock 67 API calls 12101->12105 12104 3786742 _malloc 67 API calls 12102->12104 12109 378c96c __fcloseall 12103->12109 12106 378c95c 12104->12106 12107 378c984 ___sbh_find_block 12105->12107 12108 37866da __close 6 API calls 12106->12108 12117 378c9d5 12107->12117 12108->12109 12109->12089 12114 3789276 12112->12114 12115 37892b5 12114->12115 12116 3789296 Sleep 12114->12116 12121 378cfca 12114->12121 12115->12088 12116->12114 12120 378a23a LeaveCriticalSection 12117->12120 12119 378c9b0 12119->12103 12119->12109 12120->12119 12122 378cfd6 __fcloseall 12121->12122 12123 378cfeb 12122->12123 12124 378cfdd 12122->12124 12125 378cffe 12123->12125 12126 378cff2 12123->12126 12127 378795b _malloc 67 API calls 12124->12127 12133 378d170 12125->12133 12149 378d00b ___sbh_resize_block ___sbh_find_block ___crtGetEnvironmentStringsA 12125->12149 12128 3786370 __fcloseall 67 API calls 12126->12128 12135 378cfe5 __fcloseall __dosmaperr 12127->12135 12128->12135 12129 378d1a3 12132 3788416 _malloc 6 API calls 12129->12132 12130 378d175 HeapReAlloc 12130->12133 12130->12135 12131 378a314 __lock 67 API calls 12131->12149 12134 378d1a9 12132->12134 12133->12129 12133->12130 12136 378d1c7 12133->12136 12138 3788416 _malloc 6 API calls 12133->12138 12140 378d1bd 12133->12140 12137 3786742 _malloc 67 API calls 12134->12137 12135->12114 12136->12135 12139 3786742 _malloc 67 API calls 12136->12139 12137->12135 12138->12133 12141 378d1d0 GetLastError 12139->12141 12143 3786742 _malloc 67 API calls 12140->12143 12141->12135 12155 378d13e 12143->12155 12144 378d096 HeapAlloc 12144->12149 12145 378d143 GetLastError 12145->12135 12146 378d0eb HeapReAlloc 12146->12149 12147 378ab26 ___sbh_alloc_block 5 API calls 12147->12149 12148 378d156 12148->12135 12151 3786742 _malloc 67 API calls 12148->12151 12149->12129 12149->12131 12149->12135 12149->12144 12149->12146 12149->12147 12149->12148 12150 3788416 _malloc 6 API calls 12149->12150 12152 378d139 12149->12152 12156 378a377 VirtualFree VirtualFree HeapFree __VEC_memcpy ___sbh_free_block 12149->12156 12157 378d10e 12149->12157 12150->12149 12153 378d163 12151->12153 12154 3786742 _malloc 67 API calls 12152->12154 12153->12135 12153->12141 12154->12155 12155->12135 12155->12145 12156->12149 12160 378a23a LeaveCriticalSection 12157->12160 12159 378d115 12159->12149 12160->12159 12164 378a23a LeaveCriticalSection 12161->12164 12163 37883ef 12163->12075 12164->12163 12166 378943b __fcloseall 12165->12166 12167 378a314 __lock 67 API calls 12166->12167 12168 3789442 12167->12168 12170 3787314 __decode_pointer 6 API calls 12168->12170 12175 37894fb __initterm 12168->12175 12173 3789479 12170->12173 12172 3789543 __fcloseall 12172->11414 12173->12175 12177 3787314 __decode_pointer 6 API calls 12173->12177 12182 3789546 12175->12182 12176 378953a 12178 378933f _malloc 3 API calls 12176->12178 12181 378948e 12177->12181 12178->12172 12179 378730b 6 API calls ___crtMessageBoxW 12179->12181 12180 3787314 6 API calls __decode_pointer 12180->12181 12181->12175 12181->12179 12181->12180 12183 378954c 12182->12183 12184 3789527 12182->12184 12187 378a23a LeaveCriticalSection 12183->12187 12184->12172 12186 378a23a LeaveCriticalSection 12184->12186 12186->12176 12187->12184 12189 378ceb8 __fcloseall 12188->12189 12190 378ced0 12189->12190 12200 378ceef _memset 12189->12200 12191 3786742 _malloc 66 API calls 12190->12191 12192 378ced5 12191->12192 12193 37866da __close 6 API calls 12192->12193 12195 378cee5 __fcloseall 12193->12195 12194 378cf61 RtlAllocateHeap 12194->12200 12195->11422 12196 3788416 _malloc 6 API calls 12196->12200 12197 378a314 __lock 66 API calls 12197->12200 12198 378ab26 ___sbh_alloc_block 5 API calls 12198->12200 12200->12194 12200->12195 12200->12196 12200->12197 12200->12198 12201 378cfa8 12200->12201 12204 378a23a LeaveCriticalSection 12201->12204 12203 378cfaf 12203->12200 12204->12203 12205->11438 12212 378a23a LeaveCriticalSection 12206->12212 12208 3787497 12208->11448 12213 378a23a LeaveCriticalSection 12209->12213 12211 37874e5 12211->11453 12212->12208 12213->12211 12215 378a658 12214->12215 12216 378a3b6 12214->12216 12215->11462 12216->12215 12217 378a5a2 VirtualFree 12216->12217 12218 378a606 12217->12218 12218->12215 12219 378a615 VirtualFree HeapFree 12218->12219 12224 378ca30 12219->12224 12228 378a23a LeaveCriticalSection 12221->12228 12223 37863cd 12223->11456 12225 378ca48 12224->12225 12226 378ca6f __VEC_memcpy 12225->12226 12227 378ca77 12225->12227 12226->12227 12227->12215 12228->12223 12230 3787586 __fcloseall 12229->12230 12231 378759e 12230->12231 12232 3787688 __fcloseall 12230->12232 12233 3786370 __fcloseall 67 API calls 12230->12233 12234 37875ac 12231->12234 12235 3786370 __fcloseall 67 API calls 12231->12235 12232->11468 12233->12231 12236 37875ba 12234->12236 12238 3786370 __fcloseall 67 API calls 12234->12238 12235->12234 12237 37875c8 12236->12237 12239 3786370 __fcloseall 67 API calls 12236->12239 12240 37875d6 12237->12240 12241 3786370 __fcloseall 67 API calls 12237->12241 12238->12236 12239->12237 12242 37875e4 12240->12242 12243 3786370 __fcloseall 67 API calls 12240->12243 12241->12240 12244 37875f2 12242->12244 12246 3786370 __fcloseall 67 API calls 12242->12246 12243->12242 12245 3787603 12244->12245 12247 3786370 __fcloseall 67 API calls 12244->12247 12248 378a314 __lock 67 API calls 12245->12248 12246->12244 12247->12245 12249 378760b 12248->12249 12250 3787630 12249->12250 12251 3787617 InterlockedDecrement 12249->12251 12265 3787694 12250->12265 12251->12250 12252 3787622 12251->12252 12252->12250 12256 3786370 __fcloseall 67 API calls 12252->12256 12255 378a314 __lock 67 API calls 12257 3787644 12255->12257 12256->12250 12258 378714c ___removelocaleref 8 API calls 12257->12258 12264 3787675 12257->12264 12261 3787659 12258->12261 12263 3786f74 ___freetlocinfo 67 API calls 12261->12263 12261->12264 12262 3786370 __fcloseall 67 API calls 12262->12232 12263->12264 12268 37876a0 12264->12268 12271 378a23a LeaveCriticalSection 12265->12271 12267 378763d 12267->12255 12272 378a23a LeaveCriticalSection 12268->12272 12270 3787682 12270->12262 12271->12267 12272->12270 13022 3781317 13023 3781324 13022->13023 13024 3781328 VirtualFree 13023->13024 13025 37811e3 13023->13025 13024->13025 13026 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 13025->13026 13027 37811fb 13026->13027 14229 404d31 14230 404d56 14229->14230 14231 404d3f 14229->14231 14232 404d64 IsWindowVisible 14230->14232 14240 404d7b 14230->14240 14233 404dbf 14231->14233 14234 404d45 14231->14234 14232->14233 14236 404d71 14232->14236 14237 404dc5 CallWindowProcA 14233->14237 14235 403e83 SendMessageA 14234->14235 14238 404d4f 14235->14238 14239 4046b0 5 API calls 14236->14239 14237->14238 14239->14240 14240->14237 14248 405a43 lstrcpynA 14240->14248 14242 404daa 14249 4059a1 wsprintfA 14242->14249 14244 404db1 14245 40140b 2 API calls 14244->14245 14246 404db8 14245->14246 14250 405a43 lstrcpynA 14246->14250 14248->14242 14249->14244 14250->14233 12372 401734 12373 4029e8 18 API calls 12372->12373 12374 40173b 12373->12374 12375 401761 12374->12375 12376 401759 12374->12376 12412 405a43 lstrcpynA 12375->12412 12411 405a43 lstrcpynA 12376->12411 12379 40175f 12383 405ca1 5 API calls 12379->12383 12380 40176c 12381 405536 3 API calls 12380->12381 12382 401772 lstrcatA 12381->12382 12382->12379 12384 40177e 12383->12384 12385 405d3a 2 API calls 12384->12385 12386 4056fb 2 API calls 12384->12386 12388 401795 CompareFileTime 12384->12388 12389 401859 12384->12389 12390 401830 12384->12390 12398 405a65 18 API calls 12384->12398 12402 405a43 lstrcpynA 12384->12402 12407 405304 MessageBoxIndirectA 12384->12407 12410 40571a GetFileAttributesA CreateFileA 12384->12410 12385->12384 12386->12384 12388->12384 12391 404de1 25 API calls 12389->12391 12392 404de1 25 API calls 12390->12392 12408 401845 12390->12408 12393 401863 12391->12393 12392->12408 12394 402f01 47 API calls 12393->12394 12395 401876 12394->12395 12396 40188a SetFileTime 12395->12396 12397 40189c FindCloseChangeNotification 12395->12397 12396->12397 12399 4018ad 12397->12399 12397->12408 12398->12384 12400 4018b2 12399->12400 12401 4018c5 12399->12401 12403 405a65 18 API calls 12400->12403 12404 405a65 18 API calls 12401->12404 12402->12384 12405 4018ba lstrcatA 12403->12405 12406 4018cd 12404->12406 12405->12406 12406->12408 12409 405304 MessageBoxIndirectA 12406->12409 12407->12384 12409->12408 12410->12384 12411->12379 12412->12380 14251 401934 14252 4029cb 18 API calls 14251->14252 14253 40193b 14252->14253 14254 4029cb 18 API calls 14253->14254 14255 401945 14254->14255 14256 4029e8 18 API calls 14255->14256 14257 40194e 14256->14257 14258 401961 lstrlenA 14257->14258 14259 40199c 14257->14259 14260 40196b 14258->14260 14260->14259 14264 405a43 lstrcpynA 14260->14264 14262 401985 14262->14259 14263 401992 lstrlenA 14262->14263 14263->14259 14264->14262 11066 401ec5 11067 4029e8 18 API calls 11066->11067 11068 401ecc GetFileVersionInfoSizeA 11067->11068 11069 40287d 11068->11069 11070 401eef GlobalAlloc 11068->11070 11070->11069 11071 401f03 GetFileVersionInfoA 11070->11071 11072 401f14 VerQueryValueA 11071->11072 11073 401f45 11071->11073 11072->11073 11074 401f2d 11072->11074 11073->11069 11078 4059a1 wsprintfA 11074->11078 11076 401f39 11079 4059a1 wsprintfA 11076->11079 11078->11076 11079->11073 13080 4018d8 13081 40190f 13080->13081 13082 4029e8 18 API calls 13081->13082 13083 401914 13082->13083 13084 405368 69 API calls 13083->13084 13085 40191d 13084->13085 12423 4022f5 12424 4022fb 12423->12424 12425 4029e8 18 API calls 12424->12425 12426 40230d 12425->12426 12427 4029e8 18 API calls 12426->12427 12428 402317 RegCreateKeyExA 12427->12428 12429 402341 12428->12429 12430 40287d 12428->12430 12431 402359 12429->12431 12432 4029e8 18 API calls 12429->12432 12433 402365 12431->12433 12435 4029cb 18 API calls 12431->12435 12434 402352 lstrlenA 12432->12434 12436 402380 RegSetValueExA 12433->12436 12438 402f01 47 API calls 12433->12438 12434->12431 12435->12433 12437 402396 RegCloseKey 12436->12437 12437->12430 12438->12436 14398 4027f5 14399 4029cb 18 API calls 14398->14399 14400 4027fb 14399->14400 14401 40264e 14400->14401 14402 40282c 14400->14402 14404 402809 14400->14404 14402->14401 14403 405a65 18 API calls 14402->14403 14403->14401 14404->14401 14406 4059a1 wsprintfA 14404->14406 14406->14401 14407 37836b0 14419 37857e0 14407->14419 14410 3783793 14412 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 14410->14412 14411 3783705 _memset 14421 3782a60 14411->14421 14413 37837a7 14412->14413 14415 378378d RegCloseKey 14415->14410 14416 3783749 14417 3783774 14416->14417 14418 3783763 StrStrA 14416->14418 14417->14410 14417->14415 14418->14416 14418->14417 14420 37836ba RegOpenKeyExA 14419->14420 14420->14410 14420->14411 14422 3782a7d RegQueryValueExA 14421->14422 14423 3782a6e 14421->14423 14425 3782aa8 14422->14425 14423->14422 14424 3782a73 14423->14424 14424->14416 14425->14416 11209 401389 11210 401390 11209->11210 11211 4013fe 11210->11211 11212 4013cb MulDiv SendMessageA 11210->11212 11212->11210 13659 40248e 13660 4029e8 18 API calls 13659->13660 13661 402495 13660->13661 13664 40571a GetFileAttributesA CreateFileA 13661->13664 13663 4024a1 13664->13663 13668 401e95 13669 4029e8 18 API calls 13668->13669 13670 401e9c 13669->13670 13671 405d3a 2 API calls 13670->13671 13672 401ea2 13671->13672 13674 401eb4 13672->13674 13675 4059a1 wsprintfA 13672->13675 13675->13674 13676 401696 13677 4029e8 18 API calls 13676->13677 13678 40169c GetFullPathNameA 13677->13678 13679 4016b3 13678->13679 13685 4016d4 13678->13685 13681 405d3a 2 API calls 13679->13681 13679->13685 13680 4016e8 GetShortPathNameA 13682 40287d 13680->13682 13683 4016c4 13681->13683 13683->13685 13686 405a43 lstrcpynA 13683->13686 13685->13680 13685->13682 13686->13685 12486 402299 12487 4022c9 12486->12487 12488 40229e 12486->12488 12490 4029e8 18 API calls 12487->12490 12489 402af2 19 API calls 12488->12489 12491 4022a5 12489->12491 12492 4022d0 12490->12492 12493 4029e8 18 API calls 12491->12493 12496 4022e6 12491->12496 12497 402a28 RegOpenKeyExA 12492->12497 12495 4022b6 RegDeleteValueA RegCloseKey 12493->12495 12495->12496 12498 402abc 12497->12498 12506 402a53 12497->12506 12498->12496 12499 402a79 RegEnumKeyA 12500 402a8b RegCloseKey 12499->12500 12499->12506 12502 405d61 3 API calls 12500->12502 12501 402ab0 RegCloseKey 12505 402a9f 12501->12505 12504 402a9b 12502->12504 12503 402a28 3 API calls 12503->12506 12504->12505 12507 402acb RegDeleteKeyA 12504->12507 12505->12498 12506->12499 12506->12500 12506->12501 12506->12503 12507->12505 10681 4023a1 10692 402af2 10681->10692 10683 4023ab 10684 4029e8 18 API calls 10683->10684 10685 4023b4 10684->10685 10686 4023be RegQueryValueExA 10685->10686 10690 40264e 10685->10690 10687 4023e4 RegCloseKey 10686->10687 10688 4023de 10686->10688 10687->10690 10688->10687 10696 4059a1 wsprintfA 10688->10696 10693 4029e8 18 API calls 10692->10693 10694 402b0b 10693->10694 10695 402b19 RegOpenKeyExA 10694->10695 10695->10683 10696->10687 11103 4035a6 11104 4035c1 11103->11104 11105 4035b7 CloseHandle 11103->11105 11106 4035d5 11104->11106 11107 4035cb CloseHandle 11104->11107 11105->11104 11110 405368 11106->11110 11107->11106 11111 405617 18 API calls 11110->11111 11112 40537c 11111->11112 11113 405385 DeleteFileA 11112->11113 11114 40539c 11112->11114 11143 4035e1 11113->11143 11117 4054d1 11114->11117 11148 405a43 lstrcpynA 11114->11148 11116 4053c6 11118 4053d7 11116->11118 11119 4053ca lstrcatA 11116->11119 11120 405d3a 2 API calls 11117->11120 11117->11143 11121 40557d 2 API calls 11118->11121 11123 4053dd 11119->11123 11122 4054f6 11120->11122 11121->11123 11126 405536 3 API calls 11122->11126 11122->11143 11124 4053eb lstrcatA 11123->11124 11125 4053f6 lstrlenA FindFirstFileA 11123->11125 11124->11125 11125->11117 11146 40541a 11125->11146 11127 405500 11126->11127 11129 4056fb 2 API calls 11127->11129 11128 405561 CharNextA 11128->11146 11130 405506 RemoveDirectoryA 11129->11130 11131 405511 11130->11131 11132 405528 11130->11132 11137 404de1 25 API calls 11131->11137 11131->11143 11133 404de1 25 API calls 11132->11133 11133->11143 11134 4054b0 FindNextFileA 11136 4054c8 FindClose 11134->11136 11134->11146 11136->11117 11138 40551f 11137->11138 11139 405791 39 API calls 11138->11139 11139->11143 11142 405368 60 API calls 11142->11146 11144 404de1 25 API calls 11144->11134 11145 404de1 25 API calls 11145->11146 11146->11128 11146->11134 11146->11142 11146->11144 11146->11145 11147 405791 39 API calls 11146->11147 11149 405a43 lstrcpynA 11146->11149 11150 4056fb GetFileAttributesA 11146->11150 11147->11146 11148->11116 11149->11146 11151 40547d DeleteFileA 11150->11151 11152 40570a SetFileAttributesA 11150->11152 11151->11146 11152->11151 12279 401bad 12301 4029cb 12279->12301 12281 401bb4 12282 4029cb 18 API calls 12281->12282 12283 401bbe 12282->12283 12284 401bce 12283->12284 12285 4029e8 18 API calls 12283->12285 12286 401bde 12284->12286 12287 4029e8 18 API calls 12284->12287 12285->12284 12288 401be9 12286->12288 12289 401c2d 12286->12289 12287->12286 12290 4029cb 18 API calls 12288->12290 12291 4029e8 18 API calls 12289->12291 12293 401bee 12290->12293 12292 401c32 12291->12292 12294 4029e8 18 API calls 12292->12294 12295 4029cb 18 API calls 12293->12295 12296 401c3b FindWindowExA 12294->12296 12297 401bf7 12295->12297 12300 401c59 12296->12300 12298 401c1d SendMessageA 12297->12298 12299 401bff SendMessageTimeoutA 12297->12299 12298->12300 12299->12300 12302 405a65 18 API calls 12301->12302 12303 4029df 12302->12303 12303->12281 12353 4015b3 12354 4029e8 18 API calls 12353->12354 12355 4015ba 12354->12355 12356 4055ca 4 API calls 12355->12356 12368 4015c2 12356->12368 12357 40160a 12359 40162d 12357->12359 12360 40160f 12357->12360 12358 405561 CharNextA 12362 4015d0 CreateDirectoryA 12358->12362 12364 401423 25 API calls 12359->12364 12361 401423 25 API calls 12360->12361 12363 401616 12361->12363 12365 4015e5 GetLastError 12362->12365 12362->12368 12371 405a43 lstrcpynA 12363->12371 12370 40215b 12364->12370 12367 4015f2 GetFileAttributesA 12365->12367 12365->12368 12367->12368 12368->12357 12368->12358 12369 401621 SetCurrentDirectoryA 12369->12370 12371->12369 12440 3781080 CreateFileA 12441 37810e9 ReadFile 12440->12441 12455 37811e1 12440->12455 12442 37811da CloseHandle 12441->12442 12443 3781106 12441->12443 12442->12455 12443->12442 12446 378111f SetFilePointer 12443->12446 12444 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12445 37811fb 12444->12445 12446->12442 12447 3781137 ReadFile 12446->12447 12447->12442 12448 3781154 12447->12448 12448->12442 12449 3781189 GetFileSize VirtualAlloc 12448->12449 12449->12442 12450 37811ae SetFilePointer ReadFile 12449->12450 12451 37811cd VirtualFree 12450->12451 12452 3781202 CloseHandle 12450->12452 12451->12442 12456 378121e 12452->12456 12453 37812ef 12454 3781328 VirtualFree 12453->12454 12453->12455 12454->12455 12455->12444 12456->12453 12458 3781340 12456->12458 12459 378149e 12458->12459 12462 378136c 12458->12462 12460 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12459->12460 12461 37814b1 12460->12461 12461->12453 12462->12459 12470 3781d60 12462->12470 12464 37813dd 12464->12459 12465 37813f3 12464->12465 12482 37815a0 12465->12482 12468 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12469 3781466 12468->12469 12469->12453 12471 3781d92 12470->12471 12475 3781dae 12470->12475 12472 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12471->12472 12473 3781da7 12472->12473 12473->12464 12474 3781e44 12476 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12474->12476 12475->12471 12475->12474 12477 3781dd4 12475->12477 12478 3781e59 12476->12478 12477->12474 12479 3781e11 12477->12479 12478->12464 12480 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12479->12480 12481 3781e3d 12480->12481 12481->12464 12483 37815c0 _memset 12482->12483 12484 378579a __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12483->12484 12485 3781423 12484->12485 12485->12468

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 00403225 Relevance: 75.5, APIs: 24, Strings: 19, Instructions: 270filestringcomCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 0 403225-4032ba #17 SetErrorMode OleInitialize call 405d61 SHGetFileInfoA call 405a43 GetCommandLineA call 405a43 GetModuleHandleA 7 4032c6-4032db call 405561 CharNextA 0->7 8 4032bc-4032c1 0->8 11 403340-403344 7->11 8->7 12 403346 11->12 13 4032dd-4032e0 11->13 16 403359-403371 GetTempPathA call 4031f1 12->16 14 4032e2-4032e6 13->14 15 4032e8-4032f0 13->15 14->14 14->15 17 4032f2-4032f3 15->17 18 4032f8-4032fb 15->18 25 403393-4033aa DeleteFileA call 402c5b 16->25 26 403373-403391 GetWindowsDirectoryA lstrcatA call 4031f1 16->26 17->18 20 403330-40333d call 405561 18->20 21 4032fd-403301 18->21 20->11 34 40333f 20->34 23 403311-403317 21->23 24 403303-40330c 21->24 30 403327-40332e 23->30 31 403319-403322 23->31 24->23 28 40330e 24->28 40 403411-403420 ExitProcess OleUninitialize 25->40 41 4033ac-4033b2 25->41 26->25 26->40 28->23 30->20 37 403348-403354 call 405a43 30->37 31->30 36 403324 31->36 34->11 36->30 37->16 42 403426-403436 call 405304 ExitProcess 40->42 43 40350b-403511 40->43 44 403401-403408 call 4035e3 41->44 45 4033b4-4033bd call 405561 41->45 48 403513-403530 call 405d61 * 3 43->48 49 40358e-403596 43->49 51 40340d 44->51 57 4033c8-4033ca 45->57 73 403532-403534 48->73 74 40357a-403585 ExitWindowsEx 48->74 53 403598 49->53 54 40359c-4035a0 ExitProcess 49->54 51->40 53->54 60 4033cc-4033d6 57->60 61 4033bf-4033c5 57->61 64 4033d8-4033e5 call 405617 60->64 65 40343c-403456 lstrcatA lstrcmpiA 60->65 61->60 63 4033c7 61->63 63->57 64->40 76 4033e7-4033fd call 405a43 * 2 64->76 65->40 67 403458-40346d CreateDirectoryA SetCurrentDirectoryA 65->67 70 40347a-403494 call 405a43 67->70 71 40346f-403475 call 405a43 67->71 84 403499-4034b5 call 405a65 DeleteFileA 70->84 71->70 73->74 78 403536-403538 73->78 74->49 81 403587-403589 call 40140b 74->81 76->44 78->74 82 40353a-40354c GetCurrentProcess 78->82 81->49 82->74 91 40354e-403570 82->91 92 4034f6-4034fd 84->92 93 4034b7-4034c7 CopyFileA 84->93 91->74 92->84 95 4034ff-403506 call 405791 92->95 93->92 94 4034c9-4034e9 call 405791 call 405a65 call 4052a3 93->94 94->92 105 4034eb-4034f2 CloseHandle 94->105 95->40 105->92
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • #17.COMCTL32 ref: 00403244
                                                                                                                                                                                        • SetErrorMode.KERNEL32(00008001), ref: 0040324F
                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403256
                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        • SHGetFileInfoA.SHELL32(0041F4B8,00000000,?,00000160,00000000,00000008), ref: 0040327E
                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                        • GetCommandLineA.KERNEL32(00423700,NSIS Error), ref: 00403293
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000000), ref: 004032A6
                                                                                                                                                                                        • CharNextA.USER32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000020), ref: 004032D1
                                                                                                                                                                                        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403364
                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
                                                                                                                                                                                        • DeleteFileA.KERNEL32(1033), ref: 00403398
                                                                                                                                                                                        • ExitProcess.KERNEL32(00000000), ref: 00403411
                                                                                                                                                                                        • OleUninitialize.OLE32(00000000), ref: 00403416
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403436
                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000000,00000000), ref: 00403442
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Program Files (x86)\360\360Desktop\modules), ref: 0040344E
                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
                                                                                                                                                                                        • DeleteFileA.KERNEL32(0041F0B8,0041F0B8,?,59cd53708ed730f0ef42bb01f668d936,?), ref: 004034AB
                                                                                                                                                                                        • CopyFileA.KERNEL32(C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,0041F0B8,00000001), ref: 004034BF
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,0041F0B8,0041F0B8,?,0041F0B8,00000000), ref: 004034EC
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004035A0
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                                                                                                                                        • String ID: /D=$ _?=$"$"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$1033$59cd53708ed730f0ef42bb01f668d936$@OV$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe$C:\Users\user\AppData\Local\360GameBox$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\360GameUsers$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
                                                                                                                                                                                        • API String ID: 553446912-238794774
                                                                                                                                                                                        • Opcode ID: fb41fee89ba53f5f954ddc00feaadec79406564f2c50884a474d204cec2155aa
                                                                                                                                                                                        • Instruction ID: 12b4adbb734880863a6c7b42456f84a79c3c9dcdf907d3cda67c8baecb7e3ac4
                                                                                                                                                                                        • Opcode Fuzzy Hash: fb41fee89ba53f5f954ddc00feaadec79406564f2c50884a474d204cec2155aa
                                                                                                                                                                                        • Instruction Fuzzy Hash: DD91C370A08351BFD721AFA1AD89B1B7EACAB40306F44453BF541B61D2C77C9E418B6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405368 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156filestringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 284 405368-405383 call 405617 287 405385-405397 DeleteFileA 284->287 288 40539c-4053a6 284->288 289 405530-405533 287->289 290 4053a8-4053aa 288->290 291 4053ba-4053c8 call 405a43 288->291 292 4053b0-4053b4 290->292 293 4054db-4054e1 290->293 299 4053d7-4053d8 call 40557d 291->299 300 4053ca-4053d5 lstrcatA 291->300 292->291 292->293 293->289 296 4054e3-4054e6 293->296 297 4054f0-4054f8 call 405d3a 296->297 298 4054e8-4054ee 296->298 297->289 307 4054fa-40550f call 405536 call 4056fb RemoveDirectoryA 297->307 298->289 302 4053dd-4053e0 299->302 300->302 305 4053e2-4053e9 302->305 306 4053eb-4053f1 lstrcatA 302->306 305->306 308 4053f6-405414 lstrlenA FindFirstFileA 305->308 306->308 323 405511-405515 307->323 324 405528-40552b call 404de1 307->324 310 4054d1-4054d5 308->310 311 40541a-405431 call 405561 308->311 310->293 313 4054d7 310->313 317 405433-405437 311->317 318 40543c-40543f 311->318 313->293 317->318 320 405439 317->320 321 405441-405446 318->321 322 405452-405460 call 405a43 318->322 320->318 326 4054b0-4054c2 FindNextFileA 321->326 327 405448-40544a 321->327 334 405462-40546a 322->334 335 405477-405486 call 4056fb DeleteFileA 322->335 323->298 329 405517-405526 call 404de1 call 405791 323->329 324->289 326->311 332 4054c8-4054cb FindClose 326->332 327->322 330 40544c-405450 327->330 329->289 330->322 330->326 332->310 334->326 337 40546c-405475 call 405368 334->337 343 4054a8-4054ab call 404de1 335->343 344 405488-40548c 335->344 337->326 343->326 346 4054a0-4054a6 344->346 347 40548e-40549e call 404de1 call 405791 344->347 346->326 347->326
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 00405386
                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 004053D0
                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 004053F1
                                                                                                                                                                                        • lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 004053F7
                                                                                                                                                                                        • FindFirstFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 00405408
                                                                                                                                                                                        • FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054BA
                                                                                                                                                                                        • FindClose.KERNEL32(?), ref: 004054CB
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\*.*$\*.*
                                                                                                                                                                                        • API String ID: 2035342205-3469811297
                                                                                                                                                                                        • Opcode ID: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                        • Instruction ID: 005fd70f037958758636dfc326b5af0e8b30b209f19d8c1cd7988b565b373fb6
                                                                                                                                                                                        • Opcode Fuzzy Hash: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B51E030904A447ADB216B618C89BFF3A68DF4271AF54807BF945711D2C77C4982DE6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405A65 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 195stringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 353 405a65-405a70 354 405a72-405a81 353->354 355 405a83-405aa0 353->355 354->355 356 405aa6-405aad 355->356 357 405c7e-405c82 355->357 356->357 358 405ab2-405abc 357->358 359 405c88-405c92 357->359 358->359 362 405ac2-405ac9 358->362 360 405c94-405c98 call 405a43 359->360 361 405c9d-405c9e 359->361 360->361 364 405c71 362->364 365 405acf-405b00 362->365 366 405c73-405c79 364->366 367 405c7b-405c7d 364->367 368 405b06-405b11 GetVersion 365->368 369 405c1b-405c1e 365->369 366->357 367->357 372 405b13-405b17 368->372 373 405b2b 368->373 370 405c20-405c23 369->370 371 405c4e-405c51 369->371 375 405c33-405c3f call 405a43 370->375 376 405c25-405c31 call 4059a1 370->376 378 405c53-405c5a call 405a65 371->378 379 405c5f-405c6f lstrlenA 371->379 372->373 374 405b19-405b1d 372->374 377 405b32-405b39 373->377 374->373 380 405b1f-405b23 374->380 390 405c44-405c4a 375->390 376->390 382 405b3b-405b3d 377->382 383 405b3e-405b40 377->383 378->379 379->357 380->373 386 405b25-405b29 380->386 382->383 388 405b42-405b65 call 40592a 383->388 389 405b79-405b7c 383->389 386->377 401 405c02-405c06 388->401 402 405b6b-405b74 call 405a65 388->402 393 405b8c-405b8f 389->393 394 405b7e-405b8a GetSystemDirectoryA 389->394 390->379 392 405c4c 390->392 398 405c13-405c19 call 405ca1 392->398 395 405b91-405b9f GetWindowsDirectoryA 393->395 396 405bf9-405bfb 393->396 399 405bfd-405c00 394->399 395->396 396->399 400 405ba1-405bab 396->400 398->379 399->398 399->401 404 405bc5-405bdb SHGetSpecialFolderLocation 400->404 405 405bad-405bb0 400->405 401->398 407 405c08-405c0e lstrcatA 401->407 402->399 410 405bf6 404->410 411 405bdd-405bf4 SHGetPathFromIDListA CoTaskMemFree 404->411 405->404 409 405bb2-405bb9 405->409 407->398 413 405bc1-405bc3 409->413 410->396 411->399 411->410 413->399 413->404
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetVersion.KERNEL32(00000000,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405B09
                                                                                                                                                                                        • GetSystemDirectoryA.KERNEL32(00422EA0,00000400), ref: 00405B84
                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(00422EA0,00000400), ref: 00405B97
                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405BD3
                                                                                                                                                                                        • SHGetPathFromIDListA.SHELL32(00000000,00422EA0), ref: 00405BE1
                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00405BEC
                                                                                                                                                                                        • lstrcatA.KERNEL32(00422EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C0E
                                                                                                                                                                                        • lstrlenA.KERNEL32(00422EA0,00000000,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405C60
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • \Microsoft\Internet Explorer\Quick Launch, xrefs: 00405C08
                                                                                                                                                                                        • Software\Microsoft\Windows\CurrentVersion, xrefs: 00405B53
                                                                                                                                                                                        • 59cd53708ed730f0ef42bb01f668d936, xrefs: 00405C38
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                        • API String ID: 900638850-3825088987
                                                                                                                                                                                        • Opcode ID: 469b56c69d40f599ef2b67fe3bb7f66555fc68042eb2b2e553d3e38b50134655
                                                                                                                                                                                        • Instruction ID: 9b1bf7279014b7c8101eb7e454522d29597b913ca5fabe9a72ab98517bc843d5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 469b56c69d40f599ef2b67fe3bb7f66555fc68042eb2b2e553d3e38b50134655
                                                                                                                                                                                        • Instruction Fuzzy Hash: 50512671A04A05AAEB205F68DC84B7F3B74EB11714F14023BE911B62E1D33C6982DF5E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040600A Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                        • Instruction ID: 4dd2872783d64c99001b1edb157d711bf7c17726e9b979133eda9d6147b50661
                                                                                                                                                                                        • Opcode Fuzzy Hash: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DF15671D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405D3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileA.KERNEL32(?,00422550,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 00405D45
                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405D51
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                        • API String ID: 2295610775-3404278061
                                                                                                                                                                                        • Opcode ID: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                        • Instruction ID: fa9aa61da9af08e62d153dff6cda9e4686c5a383a1128ef99b384ed87a871bf9
                                                                                                                                                                                        • Opcode Fuzzy Hash: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6DD0C9319095206BC20027286D0C84B6A59DF09330710CA73B12AF22F0D27499628AA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004035E3 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 213stringregistrylibraryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 106 4035e3-4035fb call 405d61 109 4035fd-40360d call 4059a1 106->109 110 40360f-403636 call 40592a 106->110 119 403659-403678 call 403897 call 405617 109->119 115 403638-403649 call 40592a 110->115 116 40364e-403654 lstrcatA 110->116 115->116 116->119 124 40367e-403683 119->124 125 4036ff-403707 call 405617 119->125 124->125 127 403685-4036a9 call 40592a 124->127 131 403715-40373a LoadImageA 125->131 132 403709-403710 call 405a65 125->132 127->125 133 4036ab-4036ad 127->133 135 403740-403776 RegisterClassA 131->135 136 4037c9-4037d1 call 40140b 131->136 132->131 137 4036be-4036ca lstrlenA 133->137 138 4036af-4036bc call 405561 133->138 139 40377c-4037c4 SystemParametersInfoA CreateWindowExA 135->139 140 40388d 135->140 149 4037d3-4037d6 136->149 150 4037db-4037e6 call 403897 136->150 143 4036f2-4036fa call 405536 call 405a43 137->143 144 4036cc-4036da lstrcmpiA 137->144 138->137 139->136 146 40388f-403896 140->146 143->125 144->143 148 4036dc-4036e6 GetFileAttributesA 144->148 152 4036e8-4036ea 148->152 153 4036ec-4036ed call 40557d 148->153 149->146 159 403864-40386c call 404eb3 150->159 160 4037e8-403805 ShowWindow LoadLibraryA 150->160 152->143 152->153 153->143 168 403886-403888 call 40140b 159->168 169 40386e-403874 159->169 162 403807-40380c LoadLibraryA 160->162 163 40380e-403820 GetClassInfoA 160->163 162->163 164 403822-403832 GetClassInfoA RegisterClassA 163->164 165 403838-403862 DialogBoxParamA call 40140b 163->165 164->165 165->146 168->140 169->149 171 40387a-403881 call 40140b 169->171 171->149
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        • lstrcatA.KERNEL32(1033,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
                                                                                                                                                                                        • lstrlenA.KERNEL32(00422EA0,?,?,?,00422EA0,00000000,C:\Users\user\AppData\Local\360GameBox,1033,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S), ref: 004036BF
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 004036D2
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00422EA0), ref: 004036DD
                                                                                                                                                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\360GameBox), ref: 00403726
                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                        • RegisterClassA.USER32 ref: 0040376D
                                                                                                                                                                                        • SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
                                                                                                                                                                                        • CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037BE
                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 004037F0
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd20), ref: 00403801
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,004236A0), ref: 0040381C
                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit,004236A0), ref: 00403829
                                                                                                                                                                                        • RegisterClassA.USER32(004236A0), ref: 00403832
                                                                                                                                                                                        • DialogBoxParamA.USER32(?,00000000,00403964,00000000), ref: 00403851
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$.DEFAULT\Control Panel\International$.exe$1033$@OV$C:\Users\user\AppData\Local\360GameBox$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                                                                                                                                                        • API String ID: 914957316-2188321523
                                                                                                                                                                                        • Opcode ID: de68ff42640f5c92571cf0b0f27c195ab9ad0e0da92133742f2957dbb00c9211
                                                                                                                                                                                        • Instruction ID: 94625ed8aaa298a99e1261382a478c85dd538f94d9e759fa5c435ea2279a3c1b
                                                                                                                                                                                        • Opcode Fuzzy Hash: de68ff42640f5c92571cf0b0f27c195ab9ad0e0da92133742f2957dbb00c9211
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D61B3B1604200BED620AF65AD45E2B3AADEB4474AF44447FF940B22E1D77D9E018A2E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402C5B Relevance: 31.7, APIs: 5, Strings: 13, Instructions: 203memoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 175 402c5b-402ca9 GetTickCount GetModuleFileNameA call 40571a 178 402cb5-402ce3 call 405a43 call 40557d call 405a43 GetFileSize 175->178 179 402cab-402cb0 175->179 187 402dd3-402de1 call 402bc5 178->187 188 402ce9-402d00 178->188 180 402efa-402efe 179->180 194 402eb2-402eb7 187->194 195 402de7-402dea 187->195 190 402d02 188->190 191 402d04-402d0a call 4031a8 188->191 190->191 196 402d0f-402d11 191->196 194->180 197 402e16-402e62 GlobalAlloc call 405e3b call 405749 CreateFileA 195->197 198 402dec-402e04 call 4031da call 4031a8 195->198 199 402d17-402d1d 196->199 200 402e6e-402e76 call 402bc5 196->200 224 402e64-402e69 197->224 225 402e78-402ea8 call 4031da call 402f01 197->225 198->194 227 402e0a-402e10 198->227 204 402d9d-402da1 199->204 205 402d1f-402d37 call 4056db 199->205 200->194 210 402da3-402da9 call 402bc5 204->210 211 402daa-402db0 204->211 205->211 220 402d39-402d40 205->220 210->211 212 402db2-402dc0 call 405dcd 211->212 213 402dc3-402dcd 211->213 212->213 213->187 213->188 220->211 226 402d42-402d49 220->226 224->180 235 402ead-402eb0 225->235 226->211 228 402d4b-402d52 226->228 227->194 227->197 228->211 230 402d54-402d5b 228->230 230->211 232 402d5d-402d7d 230->232 232->194 234 402d83-402d87 232->234 236 402d89-402d8d 234->236 237 402d8f-402d97 234->237 235->194 238 402eb9-402eca 235->238 236->187 236->237 237->211 239 402d99-402d9b 237->239 240 402ed2-402ed7 238->240 241 402ecc 238->241 239->211 242 402ed8-402ede 240->242 241->240 242->242 243 402ee0-402ef8 call 4056db 242->243 243->180
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402C6F
                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,00000400), ref: 00402C8B
                                                                                                                                                                                          • Part of subcall function 0040571A: GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                          • Part of subcall function 0040571A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,GBInst.exe,00000000,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 00402CD4
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00409190), ref: 00402E1B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
                                                                                                                                                                                        • Null, xrefs: 00402D54
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 00402CB6, 00402CBB, 00402CC1
                                                                                                                                                                                        • @OV, xrefs: 00402EBD
                                                                                                                                                                                        • Inst, xrefs: 00402D42
                                                                                                                                                                                        • The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t, xrefs: 00402EB2
                                                                                                                                                                                        • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
                                                                                                                                                                                        • soft, xrefs: 00402D4B
                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S, xrefs: 00402C68
                                                                                                                                                                                        • GBInst.exe, xrefs: 00402CC8
                                                                                                                                                                                        • Error launching installer, xrefs: 00402CAB
                                                                                                                                                                                        • lPV, xrefs: 00402EEE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$@OV$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$GBInst.exe$Inst$Null$The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t$lPV$soft
                                                                                                                                                                                        • API String ID: 2803837635-2818311792
                                                                                                                                                                                        • Opcode ID: 929a9361b184f8481831f9e318c9a22800816f4363022c87f3a4d53be2a937c6
                                                                                                                                                                                        • Instruction ID: 98420d4c95cb0715ed39ffe41bcd432428fd7d62b31351ae7306db0730cac7b6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 929a9361b184f8481831f9e318c9a22800816f4363022c87f3a4d53be2a937c6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C61C231E40214ABDB20DF64EE49B9A7BB4AB48315F50413BF904B72D1D7BC9E418BAD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405791 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 144filememoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 246 405791-4057a2 call 405d61 249 4057a4-4057af MoveFileExA 246->249 250 4057b5-4057d1 246->250 249->250 251 4058ee 249->251 252 4057d3-4057eb call 40571a CloseHandle GetShortPathNameA 250->252 253 4057f9-405808 GetShortPathNameA 250->253 254 4058f4-4058f8 251->254 252->254 260 4057f1-4057f3 252->260 253->254 255 40580e-405810 253->255 255->254 257 405816-405854 wsprintfA call 405a65 call 40571a 255->257 257->251 264 40585a-405876 GetFileSize GlobalAlloc 257->264 260->253 260->254 265 4058e7-4058e8 CloseHandle 264->265 266 405878-40588a ReadFile 264->266 265->251 266->265 267 40588c-405890 266->267 267->265 268 405892-40589f call 40568f 267->268 271 4058a1-4058af call 405a43 268->271 272 4058fb-40590b call 40568f 268->272 277 4058b2 271->277 272->277 278 40590d-405915 272->278 279 4058b4-4058e1 call 4056db SetFilePointer WriteFile GlobalFree 277->279 280 405922-405928 278->280 281 405917-405920 278->281 279->265 280->279 281->280 281->281
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        • MoveFileExA.KERNEL32(00000000,?,00000005,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057AB
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057DE
                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(?,00422690,00000400), ref: 004057E7
                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(00000000,00422108,00000400), ref: 00405804
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405822
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00422108,C0000000,00000004,00422108,?,?,?,00000000,000000F1,?), ref: 0040585D
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040586C
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405882
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D08,00000000,-0000000A,004093B0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004058C8
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058DA
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004058E1
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058E8
                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModuleMovePointerProcReadSizeWritewsprintf
                                                                                                                                                                                        • String ID: %s=%s$@OV$[Rename]
                                                                                                                                                                                        • API String ID: 3178728463-1420516989
                                                                                                                                                                                        • Opcode ID: 707e7d83803ccec2868aa6b1360760e81c4db2d53c34dc02baddd888dc1c6b67
                                                                                                                                                                                        • Instruction ID: b4a0761097f53e27704103e00ee6cd595734002638f7a2c326e30edaa923f398
                                                                                                                                                                                        • Opcode Fuzzy Hash: 707e7d83803ccec2868aa6b1360760e81c4db2d53c34dc02baddd888dc1c6b67
                                                                                                                                                                                        • Instruction Fuzzy Hash: 54410432A05B11BBE7206B619D49F6B3A6CEF44715F044436FD05F62D2E678A8018EBD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03783170 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 102COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 037831AA
                                                                                                                                                                                        • _memset.LIBCMT ref: 037831C7
                                                                                                                                                                                        • SHGetValueW.SHLWAPI ref: 037831F1
                                                                                                                                                                                        • PathFileExistsW.SHLWAPI(?), ref: 03783200
                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 0378320F
                                                                                                                                                                                        • _wcsrchr.LIBCMT ref: 0378321C
                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 03783238
                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 03783243
                                                                                                                                                                                        • _wcsrchr.LIBCMT ref: 03783250
                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,?,00001000,?,?,00000104,?), ref: 0378329F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exe, xrefs: 037831DF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Path$RemoveSpec_memset_wcsrchr$EnvironmentExistsExpandModuleNameStringsValue
                                                                                                                                                                                        • String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360GameBox.exe
                                                                                                                                                                                        • API String ID: 3366726608-2006824863
                                                                                                                                                                                        • Opcode ID: a37e3b380bc2b4e0f0f87fb1fb03e2e35c3076636fa398b56d92f9a1a59ab300
                                                                                                                                                                                        • Instruction ID: 051425123444408efdbc03e40b5c0697738d28f2c756745c917729ad51145c40
                                                                                                                                                                                        • Opcode Fuzzy Hash: a37e3b380bc2b4e0f0f87fb1fb03e2e35c3076636fa398b56d92f9a1a59ab300
                                                                                                                                                                                        • Instruction Fuzzy Hash: 79316F79284305BFE714FB64D849FAB73A9AF98B00F44C91DF5498A181EB74D20987A2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03781080 Relevance: 18.2, APIs: 12, Instructions: 216filememoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 442 3781080-37810e3 CreateFileA 443 37810e9-3781100 ReadFile 442->443 444 37811e1 442->444 446 37811da-37811db CloseHandle 443->446 447 3781106-378110a 443->447 445 37811e3-3781201 call 378579a 444->445 446->444 447->446 449 3781110-3781119 447->449 449->446 451 378111f-3781131 SetFilePointer 449->451 451->446 452 3781137-378114e ReadFile 451->452 452->446 453 3781154-378115b 452->453 453->446 454 378115d-3781167 453->454 454->446 455 3781169-3781171 454->455 455->446 456 3781173-3781187 455->456 456->446 457 3781189-37811ac GetFileSize VirtualAlloc 456->457 457->446 458 37811ae-37811cb SetFilePointer ReadFile 457->458 459 37811cd-37811d4 VirtualFree 458->459 460 3781202-3781233 CloseHandle call 3781010 458->460 459->446 463 3781236-3781241 460->463 464 37812f8-37812ff 463->464 465 3781247-378124d 463->465 466 3781324-3781326 464->466 467 3781309-378130c 465->467 468 3781253-3781257 465->468 470 3781328-3781330 VirtualFree 466->470 471 3781336-3781339 466->471 467->463 467->466 468->467 469 378125d-3781275 468->469 472 3781278-3781283 469->472 470->471 471->445 472->464 473 3781285-378128d 472->473 474 378128f-3781294 473->474 475 3781301-3781304 473->475 476 37812a1-37812f5 call 3781010 * 2 call 3781340 474->476 477 3781296-378129e 474->477 475->472 476->464 477->476
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,F5425BF1), ref: 037810D8
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 037810FC
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 03781128
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,000000F8,?,00000000), ref: 0378114A
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 0378118C
                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 0378119F
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 037811B5
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 037811C7
                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 037811D4
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 037811DB
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 03781203
                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03781330
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$ReadVirtual$CloseFreeHandlePointer$AllocCreateSize
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3202141896-0
                                                                                                                                                                                        • Opcode ID: ea25bdd4041928c1b5c0efa0ff9cdc97c2c7c78924c5de87cc02e884897dea8c
                                                                                                                                                                                        • Instruction ID: 6095ea84fbe6c0fcd43f80dad270e73d4e1c74607919f2965f591ed00f0d0a9b
                                                                                                                                                                                        • Opcode Fuzzy Hash: ea25bdd4041928c1b5c0efa0ff9cdc97c2c7c78924c5de87cc02e884897dea8c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B819271A40309EFDB24EF18DC45BAAB7B8FF08710F55825AF919EB280E7749941CB94
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401734 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147stringtimeCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 484 401734-401757 call 4029e8 call 4055a3 489 401761-401773 call 405a43 call 405536 lstrcatA 484->489 490 401759-40175f call 405a43 484->490 495 401778-40177e call 405ca1 489->495 490->495 500 401783-401787 495->500 501 401789-401793 call 405d3a 500->501 502 4017ba-4017bd 500->502 510 4017a5-4017b7 501->510 511 401795-4017a3 CompareFileTime 501->511 503 4017c5-4017e1 call 40571a 502->503 504 4017bf-4017c0 call 4056fb 502->504 512 4017e3-4017e6 503->512 513 401859-401882 call 404de1 call 402f01 503->513 504->503 510->502 511->510 514 4017e8-40182a call 405a43 * 2 call 405a65 call 405a43 call 405304 512->514 515 40183b-401845 call 404de1 512->515 527 401884-401888 513->527 528 40188a-401896 SetFileTime 513->528 514->500 547 401830-401831 514->547 525 40184e-401854 515->525 530 402886 525->530 527->528 529 40189c-4018a7 FindCloseChangeNotification 527->529 528->529 532 40287d-402880 529->532 533 4018ad-4018b0 529->533 535 402888-40288c 530->535 532->530 536 4018b2-4018c3 call 405a65 lstrcatA 533->536 537 4018c5-4018c8 call 405a65 533->537 543 4018cd-4021fb 536->543 537->543 548 402200-402205 543->548 549 4021fb call 405304 543->549 547->525 550 401833-401834 547->550 548->535 549->548 550->515
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\360GameBox\,C:\Users\user\AppData\Roaming\360GameUsers,00000000,00000000,00000031), ref: 00401773
                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\360GameBox\,C:\Users\user\AppData\Local\360GameBox\,00000000,00000000,C:\Users\user\AppData\Local\360GameBox\,C:\Users\user\AppData\Roaming\360GameUsers,00000000,00000000,00000031), ref: 0040179D
                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$C:\Users\user\AppData\Local\360GameBox\$C:\Users\user\AppData\Local\Temp\nsnAB77.tmp$C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\NSISdl.dll$C:\Users\user\AppData\Roaming\360GameUsers
                                                                                                                                                                                        • API String ID: 1941528284-3347195537
                                                                                                                                                                                        • Opcode ID: c6b8b9970bee9d45ebc815c6754534fa9749124c6462540bd95c5d8816cef9e4
                                                                                                                                                                                        • Instruction ID: 502ebc8251cf4d34670626f1a6973296816b4538e99af67961374f69fd5ad3b4
                                                                                                                                                                                        • Opcode Fuzzy Hash: c6b8b9970bee9d45ebc815c6754534fa9749124c6462540bd95c5d8816cef9e4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B41E371A00514BACF10BBB9DD86DAF3A69EF45368B20433BF111B11E1D67C8B418E6D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040302C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 551 40302c-403055 GetTickCount 552 403196-40319e call 402bc5 551->552 553 40305b-403086 call 4031da SetFilePointer 551->553 558 4031a0-4031a5 552->558 559 40308b-40309d 553->559 560 4030a1-4030af call 4031a8 559->560 561 40309f 559->561 564 4030b5-4030c1 560->564 565 403188-40318b 560->565 561->560 566 4030c7-4030cd 564->566 565->558 567 4030f8-403114 call 405e5b 566->567 568 4030cf-4030d5 566->568 573 403191 567->573 574 403116-40311e 567->574 568->567 569 4030d7-4030f7 call 402bc5 568->569 569->567 578 403193-403194 573->578 576 403120-403136 WriteFile 574->576 577 403152-403158 574->577 579 403138-40313c 576->579 580 40318d-40318f 576->580 577->573 581 40315a-40315c 577->581 578->558 579->580 582 40313e-40314a 579->582 580->578 581->573 583 40315e-403171 581->583 582->566 584 403150 582->584 583->559 585 403177-403186 SetFilePointer 583->585 584->583 585->552
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00403041
                                                                                                                                                                                          • Part of subcall function 004031DA: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,0001B9E4), ref: 004031E8
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
                                                                                                                                                                                        • WriteFile.KERNEL32(0040B0A0,0040E8EA,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 0040312E
                                                                                                                                                                                        • SetFilePointer.KERNEL32(001431BE,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Pointer$CountTickWrite
                                                                                                                                                                                        • String ID: @OV$@
                                                                                                                                                                                        • API String ID: 2146148272-1065378467
                                                                                                                                                                                        • Opcode ID: 9bb1637fe3a7e8d78cc3cf5a3cb65ba5c061e076c754ce29f264143e6fd1b051
                                                                                                                                                                                        • Instruction ID: b900033f33315bf13e96bf0933fc3f5ca139b675e2fdc73b2e3f7a71e75fad19
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9bb1637fe3a7e8d78cc3cf5a3cb65ba5c061e076c754ce29f264143e6fd1b051
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1641AE72505205AFC720DF18EE8496B3FBCF748356B01463FE520BA2E0D7386A459BAD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0001BA00,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
                                                                                                                                                                                        • GlobalFree.KERNELBASE(?), ref: 00402717
                                                                                                                                                                                        • WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402729
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402730
                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402748
                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3294113728-0
                                                                                                                                                                                        • Opcode ID: b1d3b1ff547f166b56dfa2d182746bf114cb3c1d76116d140a83ef0ce10bd25b
                                                                                                                                                                                        • Instruction ID: c44f166cf789c73980343851032ece5a06a24c9bd4eff2e899fc72ce2868172c
                                                                                                                                                                                        • Opcode Fuzzy Hash: b1d3b1ff547f166b56dfa2d182746bf114cb3c1d76116d140a83ef0ce10bd25b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 79318D71C00128BBDF116FA5CE89D9E7E79EF09324F10422AF914762E0C7795D419BA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03783390 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 037833D9
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,360verify.dll), ref: 0378341F
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetCIDA), ref: 03783431
                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,360verify.dll), ref: 03783447
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Library$AddressFreeLoadProc_memset
                                                                                                                                                                                        • String ID: 360verify.dll$GetCIDA
                                                                                                                                                                                        • API String ID: 278593715-1662812359
                                                                                                                                                                                        • Opcode ID: 78e691c365f9a52b86c5288b4bc9ad26f5d97681218f0cea3dc42b463b2e041b
                                                                                                                                                                                        • Instruction ID: 9d9af6f6c8c30188212161732042608ced90979f5eb49479653f485cb4ce02e0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 78e691c365f9a52b86c5288b4bc9ad26f5d97681218f0cea3dc42b463b2e041b
                                                                                                                                                                                        • Instruction Fuzzy Hash: F311E97D6443046BE321F738DC45BEFB3D89F88B10F45891DE98986181EBB8D505C6A2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004022F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 640 4022f5-40233b call 402add call 4029e8 * 2 RegCreateKeyExA 647 402341-402349 640->647 648 40287d-40288c 640->648 649 402359-40235c 647->649 650 40234b-402358 call 4029e8 lstrlenA 647->650 653 40236c-40236f 649->653 654 40235e-40236b call 4029cb 649->654 650->649 658 402380-402394 RegSetValueExA 653->658 659 402371-40237b call 402f01 653->659 654->653 660 402396 658->660 661 402399-402475 RegCloseKey 658->661 659->658 660->661 661->648
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402333
                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnAB77.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402353
                                                                                                                                                                                        • RegSetValueExA.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040238C
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp
                                                                                                                                                                                        • API String ID: 1356686001-2772363889
                                                                                                                                                                                        • Opcode ID: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                        • Instruction ID: a02971d7ffc86f6f7c629cb7da59e84f0146b185ae6196f13f615d438ff22468
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B1172B1E00108BFEB10AFA5DE8AEAF767CEB40748F10443AF505B71D1D7B99D019A68
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 665 401f51-401f5d 666 401f63-401f79 call 4029e8 * 2 665->666 667 40200b-40200d 665->667 676 401f88-401f96 LoadLibraryExA 666->676 677 401f7b-401f86 GetModuleHandleA 666->677 668 402156-40215b call 401423 667->668 675 40287d-40288c 668->675 679 401f98-401fa6 GetProcAddress 676->679 680 402004-402006 676->680 677->676 677->679 682 401fe5-401fea call 404de1 679->682 683 401fa8-401fae 679->683 680->668 687 401fef-401ff2 682->687 685 401fb0-401fbc call 401423 683->685 686 401fc7-401fdb 683->686 685->687 693 401fbe-401fc5 685->693 691 401fe0-401fe3 686->691 687->675 689 401ff8-401fff FreeLibrary 687->689 689->675 691->687 693->687
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • 59cd53708ed730f0ef42bb01f668d936, xrefs: 00401FD1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936
                                                                                                                                                                                        • API String ID: 2987980305-2406519365
                                                                                                                                                                                        • Opcode ID: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                        • Instruction ID: 0a17743dc10516c1e404603622caa6e4d13095454b29418bb929f5860ba01445
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4611D872D04115A7CF107FA4DE85EAE75B0AB44359F204237F611B62E0C77C4941965E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 694 4015b3-4015c6 call 4029e8 call 4055ca 699 4015c8-4015e3 call 405561 CreateDirectoryA 694->699 700 40160a-40160d 694->700 709 401600-401608 699->709 710 4015e5-4015f0 GetLastError 699->710 702 40162d-40215b call 401423 700->702 703 40160f-401628 call 401423 call 405a43 SetCurrentDirectoryA 700->703 716 40287d-40288c 702->716 703->716 709->699 709->700 713 4015f2-4015fb GetFileAttributesA 710->713 714 4015fd 710->714 713->709 713->714 714->709
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 004055D8
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\360GameUsers,00000000,00000000,000000F0), ref: 00401622
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360GameUsers, xrefs: 00401617
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360GameUsers
                                                                                                                                                                                        • API String ID: 3751793516-3361765771
                                                                                                                                                                                        • Opcode ID: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                        • Instruction ID: 6d25d20538d6d8534b6823f3fc6f17b8a3ed29de71c0eeeb3a5295b4bc58004c
                                                                                                                                                                                        • Opcode Fuzzy Hash: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                        • Instruction Fuzzy Hash: B6010431908150ABDB116FB55D44D7F6BB0EA52365728063FF491B22E2C23C8942D62E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405749 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 0040575C
                                                                                                                                                                                        • GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405776
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                        • API String ID: 1716503409-3741673067
                                                                                                                                                                                        • Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                        • Instruction ID: 034d2fd5f9dd90bdc64dfe9fa05123f4a2a2f766a0f29b75e345e617da869bcc
                                                                                                                                                                                        • Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9CF0A736348204BADB104F55DC04B9B7F59DF91750F14C027FE449B1C0D6B1995897A5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402F01 Relevance: 7.6, APIs: 5, Instructions: 109fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00409190,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190,0001B9E4), ref: 00402F28
                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000004,0001B9E4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190), ref: 00402F55
                                                                                                                                                                                        • ReadFile.KERNEL32(004130A0,00004000,0001B9E4,00000000,00409190,?,00402EAD,000000FF,00000000,00000000,00409190,0001B9E4), ref: 00402FAF
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,004130A0,0001B9E4,000000FF,00000000,?,00402EAD,000000FF,00000000,00000000,00409190,0001B9E4), ref: 00402FC7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Read$PointerWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2113905535-0
                                                                                                                                                                                        • Opcode ID: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                        • Instruction ID: f57f03ec19a78774be9adcd31849d1562aa90d9077fbbcd5e62cb2d9af4c63a1
                                                                                                                                                                                        • Opcode Fuzzy Hash: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D311A31901209EFDF21CF95DE44EAE7BBCEB44365F24403AF904A61E0D2749E40EB69
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(?,?,00000000,00000000,?), ref: 00402A49
                                                                                                                                                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402A8E
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402AB3
                                                                                                                                                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1912718029-0
                                                                                                                                                                                        • Opcode ID: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                        • Instruction ID: 092ce5dc9ace931e83acbc3e972042597453fb0194ad27f06f99c48de557c256
                                                                                                                                                                                        • Opcode Fuzzy Hash: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C118971A00009FFDF21AF90DE48DAB7B39EB44384B004076BA01A01A0DB749E41EE69
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                        • Opcode ID: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                        • Instruction ID: d7011ec21094a782dcbe7947fab20a41340e67ab4a77a50b5f790120b2995d27
                                                                                                                                                                                        • Opcode Fuzzy Hash: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                        • Instruction Fuzzy Hash: B52183B1A44104BEDF01AFB5CE5BAAD7A75EF41704F14047EF501B61D1D6B88940D728
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0378CEAC Relevance: 6.1, APIs: 4, Instructions: 93memoryCOMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __lock.LIBCMT ref: 0378CF28
                                                                                                                                                                                        • ___sbh_alloc_block.LIBCMT ref: 0378CF34
                                                                                                                                                                                        • _memset.LIBCMT ref: 0378CF55
                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000008,?,03794AA0,0000000C,03789237,03785C66,?,00000000,00000000,00000000,?,03787512,00000001,00000214,?,03785C66), ref: 0378CF6A
                                                                                                                                                                                          • Part of subcall function 03786742: __getptd_noexit.LIBCMT ref: 03786742
                                                                                                                                                                                          • Part of subcall function 037866DA: __decode_pointer.LIBCMT ref: 037866E5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeap___sbh_alloc_block__decode_pointer__getptd_noexit__lock_memset
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3771094184-0
                                                                                                                                                                                        • Opcode ID: 39302c853aa184b1fc144a746d82abd421e629c99cd8d82edcba7b28c702f992
                                                                                                                                                                                        • Instruction ID: 3a5d23e9b8e60b13ad2aa9c769460f253d1a3aa699c9d31e66bdafe5a6de4708
                                                                                                                                                                                        • Opcode Fuzzy Hash: 39302c853aa184b1fc144a746d82abd421e629c99cd8d82edcba7b28c702f992
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F212832A80216EBEB23FF28CC8496DF765EF45360F6C8666F9159B184D3318541CB60
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
                                                                                                                                                                                        • GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
                                                                                                                                                                                        • VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24
                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1404258612-0
                                                                                                                                                                                        • Opcode ID: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                        • Instruction ID: 5d9bf0a38514312ff05957db8cc1166864d5adc8fb1377831f0fed305f4f1e15
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                        • Instruction Fuzzy Hash: E81136B2900109BEDB01EFA5D981DAEBBB9AF04344B20803AF501F61E1D7388A55DB28
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 004055D8
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 0040566A
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 0040567A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                        • API String ID: 3248276644-3404278061
                                                                                                                                                                                        • Opcode ID: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                        • Instruction ID: 163ab709c3a69a1d20cf6f8253de986ede20969e143c641b36a5b73ea23f62c0
                                                                                                                                                                                        • Opcode Fuzzy Hash: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                        • Instruction Fuzzy Hash: F9F0F911205D5025C72222351C09AAF0A55CD623287990E3FF858B12D1CA3D8943DC6D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401389 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                        • String ID: t]V
                                                                                                                                                                                        • API String ID: 3850602802-564448838
                                                                                                                                                                                        • Opcode ID: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                        • Instruction ID: d0f03140fbd629d0c0bf1accbe8acf671ec28544698acb2ee9a16026c0f47d2e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F01F431B24210ABE7295B389D04B2A36ADE710315F10423BF855F66F1D67CDC028B4D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Char$Next$CreateDirectoryPrev
                                                                                                                                                                                        • String ID: 1033$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 4115351271-2030658151
                                                                                                                                                                                        • Opcode ID: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
                                                                                                                                                                                        • Instruction ID: 8509fc719cfacdd3e0f19311c8db3474c91ee7b64774067ccbe91e129429c82f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d9c69d8dece2bddb05ca95613e1d6fe124b38e8b49121791a09e34daebbdd31
                                                                                                                                                                                        • Instruction Fuzzy Hash: 75D0A92160AD3036CA613B273C0AFCF090C8F0232DF2500BBF804B00C68B6C5A8218EF
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040643F Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                        • Instruction ID: 46f5cb6b99077c8a932221f6f95319a4d003604abf7c8fe4deea8dd62122f91f
                                                                                                                                                                                        • Opcode Fuzzy Hash: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1EA13371D00229CBEF28CFA8C8547ADBBB1FF44309F15856AD816BB281D7785A86DF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00406640 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                        • Instruction ID: b6d6ccc853a16e4f483ba8b04077c6698ffe39116f32d6ac079e48ce0b9a1d5b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C912071D00229CBEF28CF98C844BADBBB1FF44305F15816AD816BB291D7789A86DF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00406356 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                        • Instruction ID: 9f2062d8dd3c72469bab0aaa0c4d472ca99449d25692711e554c959146fb5a05
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F812471D00229CFEF24CFA9C8447AEBBB1FB44305F25816AD816BB281C7789985DF55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405E5B Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                        • Instruction ID: 84f98c36384fe8ee64262c0bd4aeca6ab0d9deaaf6f503267966aff3759d9c01
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                        • Instruction Fuzzy Hash: DB816672D04229CBEF24CFA9C8447AEBBB0FF44305F25816AD856B7281C7785A86DF54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004062A9 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                        • Instruction ID: 87842c1f76f394e9967038b09935c6923b6a3569bddc7a9db877803d8644aafd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                        • Instruction Fuzzy Hash: BE711171D00229CFEF28CF98C844BADBBB1FB48305F15806AD816B7281D7789996DF54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004063C7 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                        • Instruction ID: f29c7650ca7732be42b715054819f9ef2f9a8d26a50ddb16a6e1c9f426a403c7
                                                                                                                                                                                        • Opcode Fuzzy Hash: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6712271E00229CBEF28CF99C844BAEBBB1FB44305F15806AD816B7281C7789996DF55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00406313 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                        • Instruction ID: 150ce1bc09a2c7df66eb9a1793004520446428f7a11f196e4037732027db8909
                                                                                                                                                                                        • Opcode Fuzzy Hash: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 31712371D00229CBEF28CF98C844BAEBBB1FF44305F15806AD816B7291C7789A96DF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401B06 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalFree.KERNEL32(00607810), ref: 00401B75
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\360GameBox\
                                                                                                                                                                                        • API String ID: 3394109436-2049418563
                                                                                                                                                                                        • Opcode ID: 9de469b44087ba0d09a5d89d25834fc8d6a7f36d38661a320ff8fe717dcdd15a
                                                                                                                                                                                        • Instruction ID: 474fb9bf02499c7a6170e06d53d4e3f45d0768bb224d9c97df738da83c32a5d1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9de469b44087ba0d09a5d89d25834fc8d6a7f36d38661a320ff8fe717dcdd15a
                                                                                                                                                                                        • Instruction Fuzzy Hash: C8219376A04500ABCB10EBA49EC5E5F73A8EB84318B24853BF211B72D1D778E9418F5D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402164 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405D3A: FindFirstFileA.KERNEL32(?,00422550,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 00405D45
                                                                                                                                                                                          • Part of subcall function 00405D3A: FindClose.KERNEL32(00000000), ref: 00405D51
                                                                                                                                                                                        • lstrlenA.KERNEL32 ref: 004021A4
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000), ref: 004021AE
                                                                                                                                                                                        • SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004021D6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1486964399-0
                                                                                                                                                                                        • Opcode ID: 18aa7cd3e417ba4bc43fa20d4712fd95ab3ac255d7fe495c772ce9c85d11a4c8
                                                                                                                                                                                        • Instruction ID: dfadddd3a7f149e4ab042d507dd47a346d6480a4d468a4495373b54fbb4845f7
                                                                                                                                                                                        • Opcode Fuzzy Hash: 18aa7cd3e417ba4bc43fa20d4712fd95ab3ac255d7fe495c772ce9c85d11a4c8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D115271E04304ABCB10EFF69949A9EB7F8AF14344F10453BA504FB2D1D6BCC9008B59
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405D61 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 310444273-0
                                                                                                                                                                                        • Opcode ID: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                        • Instruction ID: 632a00fb12e3cb8d7b800c8c05c00ea1272b68564f45bf1eadf202890d1355d3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AE08C32A04611ABC7115B20AD0897B73A8EED9B41304493EF909F6290D734AC11ABBA
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035B8
                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035CC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\, xrefs: 004035D7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\
                                                                                                                                                                                        • API String ID: 2962429428-2541260050
                                                                                                                                                                                        • Opcode ID: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                        • Instruction ID: f9564199049be1f32d817ae5fae54506e28515e34a5cdd4db7d8b8eaa5d9f10b
                                                                                                                                                                                        • Opcode Fuzzy Hash: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE0C230904A10A6C630AF3CBE499063A6C6B413317244B26F174F21F1C778AE428AA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004023A1 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                        • RegQueryValueExA.KERNEL32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023D1
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                        • Opcode ID: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                        • Instruction ID: 761649a6a3df08df281199264971948c500f78b60f5aa5b2cb2b090958000ad5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 85118271A05205EFDB15CFA4CA4C9AE7BB4EF10354F20807FE441B72C0D6B88A45EB26
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402299 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                        • RegDeleteValueA.KERNEL32(00000000,00000000,00000033), ref: 004022B8
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 004022C1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseDeleteOpenValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 849931509-0
                                                                                                                                                                                        • Opcode ID: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                        • Instruction ID: c96301186d0cc23108267263ea3d95e678ff255433b24e802bfd10008ffd0a7a
                                                                                                                                                                                        • Opcode Fuzzy Hash: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                        • Instruction Fuzzy Hash: C7F06273B00110ABDB20BBE59F4EAAE6268AB40355F10453FF101B71D1DAFD8D41976E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040571A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                        • Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                        • Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(?,00405506,?,?,?), ref: 004056FF
                                                                                                                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405711
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                        • Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                        • Instruction ID: 1a0f39e157c28011d0f8c1384ae394ffa0e61bdf00c6ebf87dc07efa44195b5a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 16C04CB1818506ABD6056B24DF0D81F7B66EF90321B108B35F569E00F0C7355C66EE1A
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037B3EE5 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,?,?,?,10012E77), ref: 037B3FCC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000003.2526016726.00000000037B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037B0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_3_37b0000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                                                        • Opcode ID: 6f13b2ab9fb6165f90046a6ae6433f02be2c231ce190419e4ab0d48d55e1bd3a
                                                                                                                                                                                        • Instruction ID: 69c61e90c11282c8f08953048c7775da88703cf2477b3982ef1aa4c76c4dbd35
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f13b2ab9fb6165f90046a6ae6433f02be2c231ce190419e4ab0d48d55e1bd3a
                                                                                                                                                                                        • Instruction Fuzzy Hash: A721AE7AA04214EFFB10EB68DD45BDEB7B4EB00760F184115F425EB2D0D774A9818A94
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037B624F Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapDestroy.KERNELBASE(?,?,037B44F1,037B4545,?,?,?), ref: 037B62EE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000003.2526016726.00000000037B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037B0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_3_37b0000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DestroyHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2435110975-0
                                                                                                                                                                                        • Opcode ID: 6f0eb917967cca3df26654e3795574d3b611a362fb12abc9e5791fead8870b4e
                                                                                                                                                                                        • Instruction ID: 47f36714411ea8699dbb5b1704d85aabafd8ba3feb1feb008660d86e0bff3158
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f0eb917967cca3df26654e3795574d3b611a362fb12abc9e5791fead8870b4e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C116136240220ABFA22DF10DCC5F99B7B5F741760F2A8425F781A7170CAB6EC01CB18
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037B61F2 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapCreate.KERNEL32(00000000,00001000,00000000,037B444B,00000001), ref: 037B6203
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000003.2526016726.00000000037B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037B0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_3_37b0000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: deedb0c4f085d02b08d532a7f1387672c145a253e8a55085e66ba4eee07c0b2b
                                                                                                                                                                                        • Instruction ID: fae586e67987ecdf0bbf6c32112b4c0ef8ebf0c58bfb4b7c569b1110cbb5ff4f
                                                                                                                                                                                        • Opcode Fuzzy Hash: deedb0c4f085d02b08d532a7f1387672c145a253e8a55085e66ba4eee07c0b2b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 06F06D746103019AFB20EB309C897E92BF5BB40682F188836E785C90A4EFB8C080A611
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402215 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040224E
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: PrivateProfileStringWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 390214022-0
                                                                                                                                                                                        • Opcode ID: c2927475e9497a9ba1c08db410f4359770c011c1dbe4487c89ce767d200da861
                                                                                                                                                                                        • Instruction ID: c3e28f33354a9bdeaec00bb895c317f9eff9eaea502077a7dac98389f1c24f9d
                                                                                                                                                                                        • Opcode Fuzzy Hash: c2927475e9497a9ba1c08db410f4359770c011c1dbe4487c89ce767d200da861
                                                                                                                                                                                        • Instruction Fuzzy Hash: CEE04F71B401256BDF507AF14E8E97F1098AB89304F64067FB601B63E2D9BC4D01826A
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402AF2 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                        • Opcode ID: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                        • Instruction ID: 62d85545fb8c015d315058fdcb0d0d57892fb31d87e90ba3457693cc688901e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                        • Instruction Fuzzy Hash: 46E086B6240108BFDB00DFA4ED47F9577ECF704301F004421B608D70A2C774E5408B58
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000000,00000000,00000000,004130A0,0040B0A0,004030AD,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000), ref: 004031BF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                        • Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                        • Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
                                                                                                                                                                                        • Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03789D26 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapCreate.KERNEL32(00000000,00001000,00000000,?,037860FE,00000001,?,?,?,03786277,?,?,?,037946F0,0000000C,03786332), ref: 03789D3B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: 06023faf3446157e7a59bf6c361668055d7cf367a5f4f4ab03a6a34716a27992
                                                                                                                                                                                        • Instruction ID: 20615087177e45e8f21550f1a3da4719c5c656177411ce9e3429c1adf504be0e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 06023faf3446157e7a59bf6c361668055d7cf367a5f4f4ab03a6a34716a27992
                                                                                                                                                                                        • Instruction Fuzzy Hash: DED05E3269030AAAEB00BF756C09B723BEC9388295F04C476BA1CC6144F678C552CA04
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037B75D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • TlsFree.KERNEL32(100115B0,037B44EC,037B4545,?,?,?), ref: 037B75E0
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000003.2526016726.00000000037B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037B0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_3_37b0000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Free
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3978063606-0
                                                                                                                                                                                        • Opcode ID: 3c298c4fbd44a8207be02205b8afb5583fedf16ed390c409380dac2476bd8d9d
                                                                                                                                                                                        • Instruction ID: f31ca271df30e306fbd56dd25a49fbdd1fd4db35d322da1109db587e764b2251
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c298c4fbd44a8207be02205b8afb5583fedf16ed390c409380dac2476bd8d9d
                                                                                                                                                                                        • Instruction Fuzzy Hash: E4C04C74404A5497E619A7388C8E58836777A812713984700E0B7C50F0E774C4424614
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,0001B9E4), ref: 004031E8
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                        • Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                        • Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
                                                                                                                                                                                        • Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                        • Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03781317 Relevance: 1.3, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03781330
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FreeVirtual
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1263568516-0
                                                                                                                                                                                        • Opcode ID: e85ab61359750e3f14df35f0839d95bf1b64098953a6fd1b417017c4f6375171
                                                                                                                                                                                        • Instruction ID: 88b08bc8b6e034a21aa2d52ffad3efb7aef06e51399f1b72199e657335637d4c
                                                                                                                                                                                        • Opcode Fuzzy Hash: e85ab61359750e3f14df35f0839d95bf1b64098953a6fd1b417017c4f6375171
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1DE09271B44309CBCB24EFA4E8827ADB760FB44720F504259ED1657780DB3569118A50
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                        Function 00404730 Relevance: 67.0, APIs: 33, Strings: 5, Instructions: 478windowmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404747
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404754
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000003), ref: 004047A0
                                                                                                                                                                                        • LoadBitmapA.USER32(0000006E), ref: 004047B3
                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000FC,00404D31), ref: 004047CD
                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047E1
                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047F5
                                                                                                                                                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 0040480A
                                                                                                                                                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404816
                                                                                                                                                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404828
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0040482D
                                                                                                                                                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404858
                                                                                                                                                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404864
                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 004048F9
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404924
                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404938
                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404967
                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404975
                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404986
                                                                                                                                                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A89
                                                                                                                                                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AEE
                                                                                                                                                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B03
                                                                                                                                                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B27
                                                                                                                                                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B4D
                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404B62
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00404B72
                                                                                                                                                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BE2
                                                                                                                                                                                        • SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C8B
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C9A
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404CBA
                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00404D08
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404D13
                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00404D1A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                        • String ID: $,QV$@OV$M$N
                                                                                                                                                                                        • API String ID: 1638840714-1003558310
                                                                                                                                                                                        • Opcode ID: 00d5072151e125040d91cee365c37ddb3e44aab28ca38f45cf86c1e1437003a2
                                                                                                                                                                                        • Instruction ID: 2f002745dd727b88aea6b3014e5fe59d6d497abb36422f7ee26b5b217c9fe0ee
                                                                                                                                                                                        • Opcode Fuzzy Hash: 00d5072151e125040d91cee365c37ddb3e44aab28ca38f45cf86c1e1437003a2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 83028BB0A40209EFDB24DF64DD45AAE7BB5FB84315F10813AF610BA2E1C7799A41CF58
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404F1F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 278windowclipboardmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 00404F7E
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00404F8D
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00404FCA
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000015), ref: 00404FD2
                                                                                                                                                                                        • SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FF3
                                                                                                                                                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405004
                                                                                                                                                                                        • SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405017
                                                                                                                                                                                        • SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405025
                                                                                                                                                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405038
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040505A
                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040506E
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040508F
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040509F
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050B8
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004050C4
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00404F9C
                                                                                                                                                                                          • Part of subcall function 00403E6C: SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004050E1
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00004EB3,00000000), ref: 004050EF
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004050F6
                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040511A
                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000008), ref: 0040511F
                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405166
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405198
                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004051A9
                                                                                                                                                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004051BE
                                                                                                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 004051D1
                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004051F5
                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405230
                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405240
                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405246
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040524F
                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405259
                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040526D
                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405285
                                                                                                                                                                                        • SetClipboardData.USER32(00000001,00000000), ref: 00405290
                                                                                                                                                                                        • CloseClipboard.USER32 ref: 00405296
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                        • String ID: @OV${
                                                                                                                                                                                        • API String ID: 590372296-61406255
                                                                                                                                                                                        • Opcode ID: f674280dbd773ff570a4733b74376f1be0f8e9295ca65a1d177e19aa462aa4e6
                                                                                                                                                                                        • Instruction ID: 54a7b5396bae693a6587d4a30afce820365ed4185083f78a013f57a3a1aa2e37
                                                                                                                                                                                        • Opcode Fuzzy Hash: f674280dbd773ff570a4733b74376f1be0f8e9295ca65a1d177e19aa462aa4e6
                                                                                                                                                                                        • Instruction Fuzzy Hash: FDA14A70900208BFDB219F60DD89AAE7F79FB04355F00417AFA05BA2A0C7795E519F99
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404275 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 242stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 004042C0
                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,?), ref: 004042EC
                                                                                                                                                                                        • SHBrowseForFolderA.SHELL32(?,0041F8D0,?), ref: 004043A1
                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 004043AC
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00422EA0,00420500), ref: 004043DE
                                                                                                                                                                                        • lstrcatA.KERNEL32(?,00422EA0), ref: 004043EA
                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 004043FA
                                                                                                                                                                                          • Part of subcall function 004052E8: GetDlgItemTextA.USER32(?,?,00000400,00404430), ref: 004052FB
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                        • GetDiskFreeSpaceA.KERNEL32(0041F4C8,?,?,0000040F,?,00000000,0041F4C8,0041F4C8,?,?,000003FB,?), ref: 0040449D
                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044B3
                                                                                                                                                                                        • SetDlgItemTextA.USER32(00000000,00000400,0041F4B8), ref: 00404507
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$@OV$A$C:\Users\user\AppData\Local\360GameBox
                                                                                                                                                                                        • API String ID: 2246997448-1359847033
                                                                                                                                                                                        • Opcode ID: 15dfb5f5222a7c90f574cdaf83bfc2db8a2ded6642e2795df1bb2acfe9a11056
                                                                                                                                                                                        • Instruction ID: 735228c1dd8b1f81b04b8bc6f92d9a1389f0a941abf34816bf15e20d5babff8a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 15dfb5f5222a7c90f574cdaf83bfc2db8a2ded6642e2795df1bb2acfe9a11056
                                                                                                                                                                                        • Instruction Fuzzy Hash: B7817DB1A00218BBDB11AFA1DD45A9F7BB8EF44314F10813BFA04B62D1C77C9A41CB69
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0378579A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32 ref: 03786846
                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0378685B
                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(0379270C), ref: 03786866
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 03786882
                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000), ref: 03786889
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2579439406-0
                                                                                                                                                                                        • Opcode ID: f8dbf82807037f877c0cb214ab57fe97281468b567d589b9ea3eb981a25ae267
                                                                                                                                                                                        • Instruction ID: cf817c912c42e07e1215b0657e6138ac414bd66f790f73b0a3c83b17c57826f8
                                                                                                                                                                                        • Opcode Fuzzy Hash: f8dbf82807037f877c0cb214ab57fe97281468b567d589b9ea3eb981a25ae267
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D21C0B4402208FFCB50FF68E0846543BF5FB0A351F15879BE50896249EB795583CF06
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402012 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134comCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402065
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040A808,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360GameUsers, xrefs: 0040209D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360GameUsers
                                                                                                                                                                                        • API String ID: 123533781-3361765771
                                                                                                                                                                                        • Opcode ID: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                        • Instruction ID: 9b89665ae90dc8b4180d3c8d33d84192eed4ab63dd5a898af4d907ee2c273e32
                                                                                                                                                                                        • Opcode Fuzzy Hash: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                        • Instruction Fuzzy Hash: F0416FB5A00104AFDB00DFA4CD89E9E7BB9EF49314B20416AF905EB2D1CA79DD41CB64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402630 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040263F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                        • Opcode ID: 8421a41e1df0c9106172ed25bea93ee113a2d5f9eb36866c73187df20ada77dd
                                                                                                                                                                                        • Instruction ID: f1be7f5fbd37878f4f010312c241429cf920c65d46553418e9b7b5770661ac32
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8421a41e1df0c9106172ed25bea93ee113a2d5f9eb36866c73187df20ada77dd
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5EF0A7726041109FD700EBB59D49EEE7768DF51324F6006BBE111F20C1C3B88A429A2A
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403964 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 004039BD
                                                                                                                                                                                        • DestroyWindow.USER32 ref: 004039D1
                                                                                                                                                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 004039ED
                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403A0E
                                                                                                                                                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A22
                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403A29
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403AD7
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403AE1
                                                                                                                                                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403AFB
                                                                                                                                                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B4C
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403BF2
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00403C13
                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C25
                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C40
                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C56
                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00403C5D
                                                                                                                                                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C75
                                                                                                                                                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C88
                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,?,00420500,00423700), ref: 00403CB1
                                                                                                                                                                                        • SetWindowTextA.USER32(?,00420500), ref: 00403CC0
                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 00403DF4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 184305955-0
                                                                                                                                                                                        • Opcode ID: aa9795fc97d7b7231353da3c5581c78f3c664ab19e9876cbfe237abc519f2bc8
                                                                                                                                                                                        • Instruction ID: 7ba81dbe19c60a8e0c3243ea337059b00a2b0f070469454242f3f43eb6e2cd92
                                                                                                                                                                                        • Opcode Fuzzy Hash: aa9795fc97d7b7231353da3c5581c78f3c664ab19e9876cbfe237abc519f2bc8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36C1A271A04204BBD7206F61ED49E2B7EBCEB45706F40053EF541B12E1C779AA429F6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403F7F Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204windowstringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040400A
                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 0040401E
                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040403C
                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040404D
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040405C
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040406B
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 00404075
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404083
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404092
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 004040F5
                                                                                                                                                                                        • SendMessageA.USER32(00000000), ref: 004040F8
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404123
                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404163
                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 00404172
                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040417B
                                                                                                                                                                                        • ShellExecuteA.SHELL32(0000070B,open,00422EA0,00000000,00000000,00000001), ref: 0040418E
                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 0040419B
                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040419E
                                                                                                                                                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 004041CA
                                                                                                                                                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 004041DE
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                        • String ID: @OV$K?@$N$open
                                                                                                                                                                                        • API String ID: 3615053054-3999685447
                                                                                                                                                                                        • Opcode ID: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                        • Instruction ID: a34f9f388cf178df8091a403f6a11dec50c515965b2aee4463b3b7977a12a790
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5461C2B1A40209BFEB109F60DD45B6A7BA9FB54705F108136FB04BA2D1C7B8A951CF98
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                        • SetTextColor.GDI32(00000000,?), ref: 00401130
                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                        • DrawTextA.USER32(00000000,Function_00023700,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                        • String ID: @OV$F
                                                                                                                                                                                        • API String ID: 941294808-1539354686
                                                                                                                                                                                        • Opcode ID: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                        • Instruction ID: ae885c784bcfecf2f3eb694ec281fa6ca416ae0fe75479e663ed1437ea50fae5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B419A71804249AFCB058FA5DD459BFBFB9FF44315F00812AF951AA1A0C738AA50DFA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03782CB0 Relevance: 22.7, APIs: 15, Instructions: 188stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782CD8
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782CEC
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782D04
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782D24
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782D38
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782D50
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782D70
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782D84
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782D9C
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782DBC
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782DD0
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782DE8
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782E03
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782E17
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782E2F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide__alloca_probe_16lstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3660014924-0
                                                                                                                                                                                        • Opcode ID: 59efe47bde33fc2adeb893cde36cb2a397034159b96c42c79337087e6d71153d
                                                                                                                                                                                        • Instruction ID: 4307df9d6fe6506270c488c96cc9a3fe2c1e9c083e3bc278ed2bc08e72ef1386
                                                                                                                                                                                        • Opcode Fuzzy Hash: 59efe47bde33fc2adeb893cde36cb2a397034159b96c42c79337087e6d71153d
                                                                                                                                                                                        • Instruction Fuzzy Hash: D5513B75A91219EBD710FF38CC85EBB7BB8EF456257144B29E922E72C5E6308D0187B0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03787400 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,037947B0,0000000C,0378753B,00000000,00000000,?,03785C66,?,?,?,?), ref: 03787412
                                                                                                                                                                                        • __crt_waiting_on_module_handle.LIBCMT ref: 0378741D
                                                                                                                                                                                          • Part of subcall function 037892BB: Sleep.KERNEL32(000003E8,?,?,03787363,KERNEL32.DLL,?,03788426,?,03787A14,03785C66,?,?,03785C66,?), ref: 037892C7
                                                                                                                                                                                          • Part of subcall function 037892BB: GetModuleHandleW.KERNEL32(03785C66,?,03787363,KERNEL32.DLL,?,03788426,?,03787A14,03785C66,?,?,03785C66,?,?,?,?), ref: 037892D0
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 03787446
                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,DecodePointer), ref: 03787456
                                                                                                                                                                                        • __lock.LIBCMT ref: 03787478
                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(89A5F3E0), ref: 03787485
                                                                                                                                                                                        • __lock.LIBCMT ref: 03787499
                                                                                                                                                                                        • ___addlocaleref.LIBCMT ref: 037874B7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                        • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                        • API String ID: 1028249917-2843748187
                                                                                                                                                                                        • Opcode ID: 53fd9d0c8cab192aa9984304ac904a4bd37fd1e70699242ba0a381d5601a0827
                                                                                                                                                                                        • Instruction ID: e04e58dbf6b0b08ecaf7e7b57e4071d23fadef97d4c29eb4b0ca98ad1aef2986
                                                                                                                                                                                        • Opcode Fuzzy Hash: 53fd9d0c8cab192aa9984304ac904a4bd37fd1e70699242ba0a381d5601a0827
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6211A575540708EEEB10FF79D848B5ABBF4AF04320F208A5EE59A97391CB749541CB60
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03782B30 Relevance: 18.2, APIs: 12, Instructions: 156stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782B58
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782B6C
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782B84
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782BA4
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782BB8
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782BD0
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782BF0
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782C04
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782C1C
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782C37
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782C4B
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782C63
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide__alloca_probe_16lstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3660014924-0
                                                                                                                                                                                        • Opcode ID: e7a8bf359cfff41b5440a41d49d63f0be6f50a58644e9f5804a4ee5c1f16847c
                                                                                                                                                                                        • Instruction ID: 6cb3fc5980d13f7c1de5dd9f88f9659d820df1068aee89c7702bbae384a5196f
                                                                                                                                                                                        • Opcode Fuzzy Hash: e7a8bf359cfff41b5440a41d49d63f0be6f50a58644e9f5804a4ee5c1f16847c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3041E979A91219ABD710FF7CCC85ABB7BA8EB45661B144B29E922D71C1F6308901C7A0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037B4DEB Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 476COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000003.2526016726.00000000037B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037B0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_3_37b0000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __aulldiv__aullrem
                                                                                                                                                                                        • String ID: $'$9$@$g$g
                                                                                                                                                                                        • API String ID: 3839614884-2311196974
                                                                                                                                                                                        • Opcode ID: 32eb65f0e083e61c1061ebccd3c14f028ad4b35eecad9f92a2c8a45571e89fc4
                                                                                                                                                                                        • Instruction ID: fc730ddd5a721e7ffc46907d662a83bb0cade0ff892c09ba15e617b2fad164d1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 32eb65f0e083e61c1061ebccd3c14f028ad4b35eecad9f92a2c8a45571e89fc4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 32029BB1C0524DEADF15CFA9C9487FDBBB8EF0A324F1C4199E850AB291D3748641DB51
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037B5A2B Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 469COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000003.2526016726.00000000037B0000.00000004.00001000.00020000.00000000.sdmp, Offset: 037B0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C1000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000003.2526016726.00000000037C6000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_3_37b0000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __aulldiv__aullrem
                                                                                                                                                                                        • String ID: $'$9$@$g$g
                                                                                                                                                                                        • API String ID: 3839614884-2311196974
                                                                                                                                                                                        • Opcode ID: 1c7b34b760220bdc0d9568fbf2ef25f70dab37a4dbe3aa30143ccc2fedc39704
                                                                                                                                                                                        • Instruction ID: b5620188cd787e4505f4eb333fb8456e79825d444de41dca81f6bfb5142d4545
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c7b34b760220bdc0d9568fbf2ef25f70dab37a4dbe3aa30143ccc2fedc39704
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9A02AF71C0124EEEDF14DFA8C9887EDBBB9EF06364F188199E810BA290D7748A45CF51
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03784ED0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127comCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 03784EF9
                                                                                                                                                                                        • CoCreateInstance.OLE32(037925C0,00000000,00000017,0379236C,?,?,00000001,?,00000000,?,00000001,?,?), ref: 03784F12
                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 03784F21
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03784F93
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03784FEC
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03785010
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 0378501F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Variant$Clear$CreateInitInitializeInstance
                                                                                                                                                                                        • String ID: \360safe
                                                                                                                                                                                        • API String ID: 4078678525-3015847306
                                                                                                                                                                                        • Opcode ID: 000edbfc27d552aef4cc5d4e3294528ddc5edab4e4acc543153f8a363ed29c72
                                                                                                                                                                                        • Instruction ID: cf7f4486ad0a2a9b306e6c41b52d994db644727175eab50c13a0e408e693d6c5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 000edbfc27d552aef4cc5d4e3294528ddc5edab4e4acc543153f8a363ed29c72
                                                                                                                                                                                        • Instruction Fuzzy Hash: F9413C75648301AFD300EF29D848A16BBE4EF8D710F458A9DF9459B361D774E805CFA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03782970 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 44registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 0378297C
                                                                                                                                                                                        • LoadCursorA.USER32 ref: 037829A0
                                                                                                                                                                                        • RegisterClassExA.USER32(00000000), ref: 037829D0
                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 037829DB
                                                                                                                                                                                        • CreateWindowExA.USER32(00000000,SetupHelper,MsgWnd,00C00000,00000000,00000000,00000064,00000064,00000000,00000000,03780000,00000000), ref: 03782A0D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ClassCreateCursorErrorLastLoadRegisterWindow_memset
                                                                                                                                                                                        • String ID: 0$MsgWnd$SetupHelper
                                                                                                                                                                                        • API String ID: 2096449335-1162629927
                                                                                                                                                                                        • Opcode ID: c85effdf279fb4ebdc4d77c20a27841a24608125ddcd6bae4efcbce639b50104
                                                                                                                                                                                        • Instruction ID: 9eb0b79c226afecbc0dee1a368f957099098d8da5b4a3f98e115e63bf1f59885
                                                                                                                                                                                        • Opcode Fuzzy Hash: c85effdf279fb4ebdc4d77c20a27841a24608125ddcd6bae4efcbce639b50104
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3201B5B42C4305BBF314FF50DC4AF0A7BE4AB44B08F508A1AF6587A1C6D6B85119CB9B
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405CA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                        • CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                        • CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • *?|<>/":, xrefs: 00405CE9
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405CA2, 00405CDD
                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S, xrefs: 00405CA7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 589700163-3128154593
                                                                                                                                                                                        • Opcode ID: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                        • Instruction ID: 5f153727bab28e9e0146d4b5ee00b331a23ca9fa80731b33480d586dfd6bff40
                                                                                                                                                                                        • Opcode Fuzzy Hash: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A119055808F912AFB3216245C44BB77F99CF567A0F28847BE5C4632C2C67C5C429B6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402B2D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 36timeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402B7C
                                                                                                                                                                                        • SetWindowTextA.USER32(?,?), ref: 00402B8C
                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402B9E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                        • String ID: @OV$unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                        • API String ID: 1451636040-3854564079
                                                                                                                                                                                        • Opcode ID: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                        • Instruction ID: c2ae3dc6e7ef4d7981284b04d028e8b0241bece3c18d328e79a1d4abe5e5a81b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                        • Instruction Fuzzy Hash: DBF01270900109ABEB219F50DD09BAE3779AB04345F00803AFA16B91D1D7B95A559B99
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000EB), ref: 00403EBB
                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 00403ED7
                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00403EE3
                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 00403EEF
                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 00403F02
                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00403F12
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00403F2C
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00403F36
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                        • Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                        • Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
                                                                                                                                                                                        • Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                        • Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037834A0 Relevance: 10.7, APIs: 7, Instructions: 156windowsleepCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 03782970: _memset.LIBCMT ref: 0378297C
                                                                                                                                                                                          • Part of subcall function 03782970: LoadCursorA.USER32 ref: 037829A0
                                                                                                                                                                                          • Part of subcall function 03782970: RegisterClassExA.USER32(00000000), ref: 037829D0
                                                                                                                                                                                          • Part of subcall function 03782970: GetLastError.KERNEL32 ref: 037829DB
                                                                                                                                                                                        • LoadIconA.USER32(03780000,00000065), ref: 037834CB
                                                                                                                                                                                        • _memset.LIBCMT ref: 037834DF
                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32 ref: 037835AB
                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000001,000001F8), ref: 03783665
                                                                                                                                                                                        • Sleep.KERNEL32(?), ref: 0378366F
                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000002,000001F8), ref: 0378367C
                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 03783683
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Icon$NotifyShell_$Load_memset$ClassCursorDestroyErrorLastRegisterSleepWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3764287842-0
                                                                                                                                                                                        • Opcode ID: f753870d2807f81dd0709b45036e334b7838acf4c67e4b775b5f31fbc49ab36c
                                                                                                                                                                                        • Instruction ID: 09946f0071216f98632c24a8fb56eb3c8338ea336266a90693a4bda8c5f93f2a
                                                                                                                                                                                        • Opcode Fuzzy Hash: f753870d2807f81dd0709b45036e334b7838acf4c67e4b775b5f31fbc49ab36c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3151037C64A3418FF722EF2CC5447ABBBE8BF85B04F18495DE4868B381E77485088792
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037836B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000000,00020019,?), ref: 037836F7
                                                                                                                                                                                        • _memset.LIBCMT ref: 03783729
                                                                                                                                                                                        • StrStrA.SHLWAPI(?,?,PendingFileRenameOperations,?,?), ref: 03783765
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,PendingFileRenameOperations,?,?), ref: 0378378D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 037836DF
                                                                                                                                                                                        • PendingFileRenameOperations, xrefs: 0378373B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseOpen_memset
                                                                                                                                                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                                                                                                                        • API String ID: 17851891-3023217399
                                                                                                                                                                                        • Opcode ID: 56a5be51cdb268a03c626e7c389ada8d568a64844644e8db53499c76c6409482
                                                                                                                                                                                        • Instruction ID: 87c62ad4cadf568a9b3517e4779fda9c9de3768fb292ab08d92d0a36dc20018b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 56a5be51cdb268a03c626e7c389ada8d568a64844644e8db53499c76c6409482
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C21A0BA548304ABE710FF28D8C08AFF7ECAB88B44F444A2EF54997111D734D9458B92
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404DE1 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                        • lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                        • lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                        • SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2531174081-0
                                                                                                                                                                                        • Opcode ID: c759d5bcfee361b0ca538f64dd674f8afe2e15b12f95dc75770de0e433f21ee7
                                                                                                                                                                                        • Instruction ID: 2cf2fc7e43d6ef2041dab6756eebc4073d6c30a41a9daa52e20b0ba15f173232
                                                                                                                                                                                        • Opcode Fuzzy Hash: c759d5bcfee361b0ca538f64dd674f8afe2e15b12f95dc75770de0e433f21ee7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 94217CB1A00108BECB119FA5CD84ADFBFB9FB44354F14807AFA04A6290C3388E419F98
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004046B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046CB
                                                                                                                                                                                        • GetMessagePos.USER32 ref: 004046D3
                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 004046ED
                                                                                                                                                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004046FF
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404725
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                        • Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                        • Instruction ID: 0faaf10df4b3c5b013205b28b163586d08db614e614b64859ce527e54ea6c82f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D014071D00219BADB01DBA4DD45BEEBBB8AB55711F10412AFA10B71C0D7B469018B95
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03782E80 Relevance: 9.1, APIs: 6, Instructions: 89stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782EA8
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782EBC
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782ED4
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 03782EEF
                                                                                                                                                                                        • __alloca_probe_16.LIBCMT ref: 03782F03
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 03782F1B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWide__alloca_probe_16lstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3660014924-0
                                                                                                                                                                                        • Opcode ID: e67ed99c7cf9e0e17f7e43763ef6f04c89ef618d8fcec7aeffaf376f630b1c74
                                                                                                                                                                                        • Instruction ID: 297899a1de731069a72faa3b7712cef87c001a98c4982806e65f56b4fee9cec0
                                                                                                                                                                                        • Opcode Fuzzy Hash: e67ed99c7cf9e0e17f7e43763ef6f04c89ef618d8fcec7aeffaf376f630b1c74
                                                                                                                                                                                        • Instruction Fuzzy Hash: 71210B79A51208FBD710FF78CC899BBB7B8EF45661B244B29ED12D7181E6308D05C790
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0378879E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __CreateFrameInfo.LIBCMT ref: 037887C6
                                                                                                                                                                                          • Part of subcall function 03785FE4: __getptd.LIBCMT ref: 03785FF2
                                                                                                                                                                                          • Part of subcall function 03785FE4: __getptd.LIBCMT ref: 03786000
                                                                                                                                                                                        • __getptd.LIBCMT ref: 037887D0
                                                                                                                                                                                          • Part of subcall function 03787560: __getptd_noexit.LIBCMT ref: 03787563
                                                                                                                                                                                          • Part of subcall function 03787560: __amsg_exit.LIBCMT ref: 03787570
                                                                                                                                                                                        • __getptd.LIBCMT ref: 037887DE
                                                                                                                                                                                        • __getptd.LIBCMT ref: 037887EC
                                                                                                                                                                                        • __getptd.LIBCMT ref: 037887F7
                                                                                                                                                                                        • _CallCatchBlock2.LIBCMT ref: 0378881D
                                                                                                                                                                                          • Part of subcall function 03786089: __CallSettingFrame@12.LIBCMT ref: 037860D5
                                                                                                                                                                                          • Part of subcall function 037888C4: __getptd.LIBCMT ref: 037888D3
                                                                                                                                                                                          • Part of subcall function 037888C4: __getptd.LIBCMT ref: 037888E1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1602911419-0
                                                                                                                                                                                        • Opcode ID: ee4aa7677ddc1f70e2a87b9664ad0918d6d95f23abfc864dd7e90476e537490f
                                                                                                                                                                                        • Instruction ID: 5d15a5bfe5519bebe3f711c22b921f06751473bf037e3bfd60a8ec818069c84f
                                                                                                                                                                                        • Opcode Fuzzy Hash: ee4aa7677ddc1f70e2a87b9664ad0918d6d95f23abfc864dd7e90476e537490f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7611E9B5D41349EFDF04EFA4D848AEE7BB0FF04314F108469E924AB251DB389A159F54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403897 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,00423700), ref: 0040392F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                        • String ID: ,QV$1033$@OV$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 530164218-4179038000
                                                                                                                                                                                        • Opcode ID: a2d008e39f389681bd3f84ce19f2f791124a33e6f2f80e92008ba66b1dfddce4
                                                                                                                                                                                        • Instruction ID: 2adf9cbe04a35390a97661ff7fb7b78584b9eec01914685aa61950304d63ee05
                                                                                                                                                                                        • Opcode Fuzzy Hash: a2d008e39f389681bd3f84ce19f2f791124a33e6f2f80e92008ba66b1dfddce4
                                                                                                                                                                                        • Instruction Fuzzy Hash: A911CFB1F046119BC734AF15EC809377BBDEB88726369817BE901A73D1C63D9A029A58
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000), ref: 00402BDD
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402BFB
                                                                                                                                                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D
                                                                                                                                                                                          • Part of subcall function 00402BA9: MulDiv.KERNEL32(00000000,00000064,?), ref: 00402BBE
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402C29
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                        • API String ID: 632923820-2449383134
                                                                                                                                                                                        • Opcode ID: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                        • Instruction ID: f5379eef49564d08d05b70d449bc26bfa371e2d4fe50783bab2c047c33a3c2e3
                                                                                                                                                                                        • Opcode Fuzzy Hash: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A01927090D225EBDB216F55EE4C99F7B78AB04701B104137F401B12D5C6BCA986CBAE
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037884ED Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __getptd.LIBCMT ref: 03788507
                                                                                                                                                                                          • Part of subcall function 03787560: __getptd_noexit.LIBCMT ref: 03787563
                                                                                                                                                                                          • Part of subcall function 03787560: __amsg_exit.LIBCMT ref: 03787570
                                                                                                                                                                                        • __getptd.LIBCMT ref: 03788518
                                                                                                                                                                                        • __getptd.LIBCMT ref: 03788526
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                        • String ID: MOC$csm
                                                                                                                                                                                        • API String ID: 803148776-1389381023
                                                                                                                                                                                        • Opcode ID: c66440dd2a2d93f0209224d2705016ad210aaab4b5b6b68ba6c2cda2ba3fd108
                                                                                                                                                                                        • Instruction ID: c0dbd3794296ee782cac5beff0a18a17b8b75eaea4862ded54fd973e4bfa3863
                                                                                                                                                                                        • Opcode Fuzzy Hash: c66440dd2a2d93f0209224d2705016ad210aaab4b5b6b68ba6c2cda2ba3fd108
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE08C795813089FC724FB68D088F2837A8FB4A315FA940E1D40ECF322E734E8809693
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03786AB7 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __getptd.LIBCMT ref: 03786AC3
                                                                                                                                                                                          • Part of subcall function 03787560: __getptd_noexit.LIBCMT ref: 03787563
                                                                                                                                                                                          • Part of subcall function 03787560: __amsg_exit.LIBCMT ref: 03787570
                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 03786AE3
                                                                                                                                                                                        • __lock.LIBCMT ref: 03786AF3
                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 03786B10
                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(038D16B0), ref: 03786B3B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4271482742-0
                                                                                                                                                                                        • Opcode ID: 5be68f0e009f9822a34bc626338d84960ef911a7ee3d9794127d65c198e2b8ca
                                                                                                                                                                                        • Instruction ID: 3ec4e17d0ab715af5693de8b42ae2056ecfd4c876390f92caf6fc90bebf64745
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5be68f0e009f9822a34bc626338d84960ef911a7ee3d9794127d65c198e2b8ca
                                                                                                                                                                                        • Instruction Fuzzy Hash: E801DB35A81714FBDB14FB69984875DB7A0BF05B20F15825EE5146B284CB385841CFD1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03786370 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __lock.LIBCMT ref: 0378638E
                                                                                                                                                                                          • Part of subcall function 0378A314: __mtinitlocknum.LIBCMT ref: 0378A32A
                                                                                                                                                                                          • Part of subcall function 0378A314: __amsg_exit.LIBCMT ref: 0378A336
                                                                                                                                                                                          • Part of subcall function 0378A314: EnterCriticalSection.KERNEL32(?,?,?,0378CF2D,00000004,03794AA0,0000000C,03789237,03785C66,?,00000000,00000000,00000000,?,03787512,00000001), ref: 0378A33E
                                                                                                                                                                                        • ___sbh_find_block.LIBCMT ref: 03786399
                                                                                                                                                                                        • ___sbh_free_block.LIBCMT ref: 037863A8
                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,03785C66,03794710,0000000C,0378A2F5,00000000,03794A40,0000000C,0378A32F,03785C66,?,?,0378CF2D,00000004,03794AA0,0000000C), ref: 037863D8
                                                                                                                                                                                        • GetLastError.KERNEL32(?,0378CF2D,00000004,03794AA0,0000000C,03789237,03785C66,?,00000000,00000000,00000000,?,03787512,00000001,00000214), ref: 037863E9
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2714421763-0
                                                                                                                                                                                        • Opcode ID: 9e3745e989d51546d8ecb1edaa7091fac1918d3eace905b18d443011ea97b403
                                                                                                                                                                                        • Instruction ID: 3ed7c74305041b7f517b2286dd1ab2a78d71361605b0f32f3877c96f9f84f6cd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e3745e989d51546d8ecb1edaa7091fac1918d3eace905b18d443011ea97b403
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A01813598130AFADF24FB71AC0DB5E7B74AF09720F14416EF720AE880DB388545DA94
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?), ref: 00401CC5
                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401CD2
                                                                                                                                                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D10
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                        • Opcode ID: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                        • Instruction ID: 73f510c38aede9d1999832a0848f44238895318cfbb720f21bd33ecac166bac3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                        • Instruction Fuzzy Hash: 57F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004055CA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe" /S,75922EE0), ref: 004055D8
                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                        • String ID: C:\$|S@
                                                                                                                                                                                        • API String ID: 3213498283-628904129
                                                                                                                                                                                        • Opcode ID: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                        • Instruction ID: 59c8476761b09c245942ad27e65994d154511812b78a9f1548afb2a8e03f2f93
                                                                                                                                                                                        • Opcode Fuzzy Hash: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6F02751904E2166E73262644C04B3B979CDB95310F080837E201B71D1C2B84C82DFAE
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004045CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,00420500,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044EE,000000DF,?,00000000,00000400), ref: 0040465C
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00404664
                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00420500), ref: 00404677
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                        • Opcode ID: a1f483348180a604368abe57e5e97d271cf2ba409d1936ba80aa741df01b1b7d
                                                                                                                                                                                        • Instruction ID: 9ef1d31d43ed7f04e774dbb7b0bf9bfadd02bf4a4dcb113ad37d7c9c7133e094
                                                                                                                                                                                        • Opcode Fuzzy Hash: a1f483348180a604368abe57e5e97d271cf2ba409d1936ba80aa741df01b1b7d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 23110473B001243BDB10A66D9C46EEF329EDBC6334F14023BF625F61D1E9789D1186A9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404D31 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00404D67
                                                                                                                                                                                        • CallWindowProcA.USER32(?,00000200,?,?), ref: 00404DD5
                                                                                                                                                                                          • Part of subcall function 00403E83: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403E95
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                        • String ID: $59cd53708ed730f0ef42bb01f668d936
                                                                                                                                                                                        • API String ID: 3748168415-793434733
                                                                                                                                                                                        • Opcode ID: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                        • Instruction ID: ca4354f5c4b8917eef9c40a956cdd667d29c971957ea1c54f02525437b92d001
                                                                                                                                                                                        • Opcode Fuzzy Hash: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B116D71600219BBDF21AF51EC80A9B3A69AF84365F40813BFB08651A1C7789D918FA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03788B4B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ___BuildCatchObject.LIBCMT ref: 03788B5E
                                                                                                                                                                                          • Part of subcall function 03788AB9: ___BuildCatchObjectHelper.LIBCMT ref: 03788AEF
                                                                                                                                                                                        • _UnwindNestedFrames.LIBCMT ref: 03788B75
                                                                                                                                                                                        • ___FrameUnwindToState.LIBCMT ref: 03788B83
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                        • API String ID: 2163707966-1018135373
                                                                                                                                                                                        • Opcode ID: 8f3e6c04d4d432192232fe851b12777bca55f561a217a48fe7ced96e7c89aee0
                                                                                                                                                                                        • Instruction ID: 787a263d71386139003dab767ff75fe1a54df4849d780c7f584179b99463c27c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8f3e6c04d4d432192232fe851b12777bca55f561a217a48fe7ced96e7c89aee0
                                                                                                                                                                                        • Instruction Fuzzy Hash: 49012476041209BBCF12BF55CC48EEA7F6AEF49350F448014BD2829120E732D9B1EBA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0378F4EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(KERNEL32,0378E996), ref: 0378F4F3
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0378F503
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleModuleProc
                                                                                                                                                                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                        • API String ID: 1646373207-3105848591
                                                                                                                                                                                        • Opcode ID: 1bb26e96987cbfa0f2758cbd406ffbd580e59f5c0d6055096a78b3c49178af94
                                                                                                                                                                                        • Instruction ID: c6d867eaf95388ce513886b2bab73effd7a005bd4fdd3ff6580c284dc29ad003
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bb26e96987cbfa0f2758cbd406ffbd580e59f5c0d6055096a78b3c49178af94
                                                                                                                                                                                        • Instruction Fuzzy Hash: B2F0363194090DD2DF10BBA6BD0A66E7A74BB80746F8746D1D196A0089DF7480B6D251
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004052A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24processCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422508,Error launching installer), ref: 004052C8
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 004052D5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004052A3
                                                                                                                                                                                        • Error launching installer, xrefs: 004052B6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
                                                                                                                                                                                        • API String ID: 3712363035-7751565
                                                                                                                                                                                        • Opcode ID: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                        • Instruction ID: ecae64e874cd01a2b34c598d60022b54c52eec95b920328752207242d2311f01
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                        • Instruction Fuzzy Hash: 31E0ECB4A00209BBDB009F64ED09E6B7BBDEB04304F90C522A911E2190D778E9508A79
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040553C
                                                                                                                                                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405545
                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C), ref: 00405556
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405536
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 2659869361-823278215
                                                                                                                                                                                        • Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                        • Instruction ID: a8815a40c5cf52564b0ee38fd83154c3193b14c3492e6d39585f1257e3d031c0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 82D0A9A2605A30BEE20232198C09E8B2A09CF02310B054422F200B62D2C2BC8E018FFE
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0378D778 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0378D7AC
                                                                                                                                                                                        • __isleadbyte_l.LIBCMT ref: 0378D7E0
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 0378D811
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 0378D87F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3058430110-0
                                                                                                                                                                                        • Opcode ID: 32aee3fb0eb9a1b13372de0e1f1da7a189047868f184a7a0f4c8c4496e07d174
                                                                                                                                                                                        • Instruction ID: 2a03cf953194518817f6b0b2853640138d1b57b038801eacc230bde01db7b2c9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 32aee3fb0eb9a1b13372de0e1f1da7a189047868f184a7a0f4c8c4496e07d174
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0F31B031A80249EFDB30FF65C884DAE7BB5AF01320F1989ADE4659B1E1D730D940DB50
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0378F3DA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3016257755-0
                                                                                                                                                                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                        • Instruction ID: 54502ca2d9793985570c994b8ec2dae308584d88b72b089c1f9ca7c37fda6316
                                                                                                                                                                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F117B3648414ABBCF12AF84EC45CEE7F72BB58290B488416FE1858030D333C9B2EB81
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03783629 Relevance: 6.0, APIs: 4, Instructions: 39windowsleepCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000001,000001F8), ref: 03783665
                                                                                                                                                                                        • Sleep.KERNEL32(?), ref: 0378366F
                                                                                                                                                                                        • Shell_NotifyIconA.SHELL32(00000002,000001F8), ref: 0378367C
                                                                                                                                                                                        • DestroyWindow.USER32(?), ref: 03783683
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: IconNotifyShell_$DestroySleepWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1659771325-0
                                                                                                                                                                                        • Opcode ID: f1f335e192b218b70e8ef380c5da4ebf1f7c7f58f2a54cf402c6db0f97ec4169
                                                                                                                                                                                        • Instruction ID: caea022350e4d1bbc83034aa836e9365db99a9868c343041b32dde874c43160f
                                                                                                                                                                                        • Opcode Fuzzy Hash: f1f335e192b218b70e8ef380c5da4ebf1f7c7f58f2a54cf402c6db0f97ec4169
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE01F4392453418FE720EF6CD488BBAB7A4FF85B04F08490CE1868B282D7759408C7A3
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03785C47 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _malloc.LIBCMT ref: 03785C61
                                                                                                                                                                                          • Part of subcall function 0378795B: __FF_MSGBANNER.LIBCMT ref: 0378797E
                                                                                                                                                                                          • Part of subcall function 0378795B: __NMSG_WRITE.LIBCMT ref: 03787985
                                                                                                                                                                                          • Part of subcall function 0378795B: HeapAlloc.KERNEL32(00000000,03785C57,?,00000000,?,?,03785C66,?,?,?,?), ref: 037879D2
                                                                                                                                                                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 03785C84
                                                                                                                                                                                          • Part of subcall function 03785BDD: std::exception::exception.LIBCMT ref: 03785BE9
                                                                                                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 03785C98
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 03785CA6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3622535130-0
                                                                                                                                                                                        • Opcode ID: 32abbc16da47a89881bd084cf9ae836c4e3a9d7f693c9d5ef0448393b0a8ebb5
                                                                                                                                                                                        • Instruction ID: 2bc68a20d5858a2e1ac207e0b9fbc95ea9e2fdd58c7a03ca3f288362634124a8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 32abbc16da47a89881bd084cf9ae836c4e3a9d7f693c9d5ef0448393b0a8ebb5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 58F0277958030B37DF04FB60EC1DD5C3BE8AB03634B184165DC259D080EFA0D60E8D82
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D22
                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000), ref: 00401D29
                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
                                                                                                                                                                                        • CreateFontIndirectA.GDI32(004093C8), ref: 00401D8A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirect
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3272661963-0
                                                                                                                                                                                        • Opcode ID: 100c72953127ba74b3ffacdb8c035c853e526958bf64125969925e674c33152d
                                                                                                                                                                                        • Instruction ID: 7786b31e84b17939d49dd2ad1307eeb8220d0898c8d3ce275e00d9fc0f48c68a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 100c72953127ba74b3ffacdb8c035c853e526958bf64125969925e674c33152d
                                                                                                                                                                                        • Instruction Fuzzy Hash: E7F0C8B0959740AEE7005770AE6E7993F64A719705F245435F542FA1E3C1BC0800CF3E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03787223 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __getptd.LIBCMT ref: 0378722F
                                                                                                                                                                                          • Part of subcall function 03787560: __getptd_noexit.LIBCMT ref: 03787563
                                                                                                                                                                                          • Part of subcall function 03787560: __amsg_exit.LIBCMT ref: 03787570
                                                                                                                                                                                        • __getptd.LIBCMT ref: 03787246
                                                                                                                                                                                        • __amsg_exit.LIBCMT ref: 03787254
                                                                                                                                                                                        • __lock.LIBCMT ref: 03787264
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3521780317-0
                                                                                                                                                                                        • Opcode ID: faf486fe35c327601a2df8017802613b5be061de954a11092df7f0bc33a0e0ee
                                                                                                                                                                                        • Instruction ID: b005b45cbf4e9bc52f4e602afbe16551a25ebe265f84065647b5af10cf71fa2e
                                                                                                                                                                                        • Opcode Fuzzy Hash: faf486fe35c327601a2df8017802613b5be061de954a11092df7f0bc33a0e0ee
                                                                                                                                                                                        • Instruction Fuzzy Hash: DAF0BE3AAC0744CBD768FB748809B5D73F0AF01B20F24828AE556AF780CB349942CB51
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 03785420 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 03784ED0: CoInitialize.OLE32(00000000), ref: 03784EF9
                                                                                                                                                                                          • Part of subcall function 03784ED0: CoCreateInstance.OLE32(037925C0,00000000,00000017,0379236C,?,?,00000001,?,00000000,?,00000001,?,?), ref: 03784F12
                                                                                                                                                                                          • Part of subcall function 03784ED0: VariantInit.OLEAUT32(?), ref: 03784F21
                                                                                                                                                                                          • Part of subcall function 03784ED0: VariantClear.OLEAUT32(?), ref: 03784F93
                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 03785546
                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 03785573
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Variant$Clear$CreateInitInitializeInstancelstrcmpi
                                                                                                                                                                                        • String ID: \360safe
                                                                                                                                                                                        • API String ID: 3663946141-3015847306
                                                                                                                                                                                        • Opcode ID: 9a00dc058c766ceb9bfe261f15666eb6d0e9afa7054822904528898934171398
                                                                                                                                                                                        • Instruction ID: 42d8ad74c75ca26aac0a7f1fec49420285127ce656730be3b169667f7f476cec
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a00dc058c766ceb9bfe261f15666eb6d0e9afa7054822904528898934171398
                                                                                                                                                                                        • Instruction Fuzzy Hash: 879139752083809FC710EF69C884A1AFBE5BFCA314F18495DF6898B361C775E845CB52
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 037888C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 03786037: __getptd.LIBCMT ref: 0378603D
                                                                                                                                                                                          • Part of subcall function 03786037: __getptd.LIBCMT ref: 0378604D
                                                                                                                                                                                        • __getptd.LIBCMT ref: 037888D3
                                                                                                                                                                                          • Part of subcall function 03787560: __getptd_noexit.LIBCMT ref: 03787563
                                                                                                                                                                                          • Part of subcall function 03787560: __amsg_exit.LIBCMT ref: 03787570
                                                                                                                                                                                        • __getptd.LIBCMT ref: 037888E1
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2552122136.0000000003781000.00000020.00000001.01000000.0000001A.sdmp, Offset: 03780000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552066780.0000000003780000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552193222.0000000003792000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552253767.0000000003796000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2552313745.000000000379B000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_3780000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                        • API String ID: 803148776-1018135373
                                                                                                                                                                                        • Opcode ID: f73113885947e346de892d8ea61c2b13e5626ffc491c09d8517882f6d22f50fc
                                                                                                                                                                                        • Instruction ID: 84a1d4c9760a4372ac3fcb9fc737be94b906208bf4bfb33ebc36c9e72449b907
                                                                                                                                                                                        • Opcode Fuzzy Hash: f73113885947e346de892d8ea61c2b13e5626ffc491c09d8517882f6d22f50fc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 45018638841304AECF38FF64C454B6DB3B5BF05211FA8595ED0955A650DB34C992CB53
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004024B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000011), ref: 004024CE
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\NSISdl.dll,00000000,?,?,00000000,00000011), ref: 004024ED
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\NSISdl.dll, xrefs: 004024BC, 004024E1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileWritelstrlen
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsnAB77.tmp\NSISdl.dll
                                                                                                                                                                                        • API String ID: 427699356-2693405001
                                                                                                                                                                                        • Opcode ID: ec73b0ea958737a39775a32ef629937405cc1c2eb869aa0fe21db0d8c20fe45b
                                                                                                                                                                                        • Instruction ID: bca52da527a61a3068b9a7417769ad1d2fd465c434b27635418a89c8b40edd75
                                                                                                                                                                                        • Opcode Fuzzy Hash: ec73b0ea958737a39775a32ef629937405cc1c2eb869aa0fe21db0d8c20fe45b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CF0E9B2A54240BFD700EBE19E49AAB3668DB41305F20843BB142F51C2D6BD89819B3D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404EB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32comCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00404EC3
                                                                                                                                                                                          • Part of subcall function 00403E83: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403E95
                                                                                                                                                                                        • OleUninitialize.OLE32(00000404,00000000), ref: 00404F0F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InitializeMessageSendUninitialize
                                                                                                                                                                                        • String ID: ,QV
                                                                                                                                                                                        • API String ID: 2896919175-4022271554
                                                                                                                                                                                        • Opcode ID: edcd20cd460aa4d3cba1c03992ab6c53ac8d5b683c22fa009725c0b4c79ebaa8
                                                                                                                                                                                        • Instruction ID: 0b073d7de411a0cd03ac481477d16169b9bc309c4d821d0b41389a3bf3bb0ba9
                                                                                                                                                                                        • Opcode Fuzzy Hash: edcd20cd460aa4d3cba1c03992ab6c53ac8d5b683c22fa009725c0b4c79ebaa8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 33F0F0B6E042009AE3209F54EE00B16B674ABD8706F06043EFF04A22E0C77989028AAD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040557D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 00405583
                                                                                                                                                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,C:\Program Files (x86)\360\360Desktop\modules\GBInst.exe,80000000,00000003), ref: 00405591
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 0040557D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                        • String ID: C:\Program Files (x86)\360\360Desktop\modules
                                                                                                                                                                                        • API String ID: 2709904686-4274933745
                                                                                                                                                                                        • Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                        • Instruction ID: a78a31216ab9b60c328ce82f5fccc260d5afe3ad280ceae17d90b4b54361c34b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                        • Instruction Fuzzy Hash: 56D09E62509AA06EE30266549C04B9B6A49DB16710F195862E540A6195C2785D418EA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040568F Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004056AF
                                                                                                                                                                                        • CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004056BD
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2544507775.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2543864625.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2544581814.0000000000407000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000409000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000421000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000426000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546487459.0000000000429000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2546948815.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_GBInst.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                        • Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                        • Instruction ID: f65b762de9c196bf4895d9b9c03b18621a66a0ffa1d04d6b890c27cf309056ad
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0EF0A736249D51DBC2025B655C04E7B7E94EF92354B640D7AF444F2240D33A98159FBF
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                        Execution Coverage:7.9%
                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:49.8%
                                                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                                                        Total number of Nodes:1476
                                                                                                                                                                                        Total number of Limit Nodes:45
                                                                                                                                                                                        execution_graph 11327 21c1110 11328 21c1127 11327->11328 11329 21c11e3 11327->11329 11328->11329 11338 21c2af0 11328->11338 11332 21c117e 11362 21c3a3f 11332->11362 11333 21c1182 lstrlenA 11334 21c3ab0 11333->11334 11335 21c119f MultiByteToWideChar 11334->11335 11335->11332 11340 21c2afa 11338->11340 11339 21c115c 11339->11332 11339->11333 11340->11339 11341 21c2f10 63 API calls 11340->11341 11342 21c2b22 11341->11342 11342->11339 11343 21c2b2d 11342->11343 11344 21c2a40 48 API calls 11343->11344 11345 21c2b48 11344->11345 11346 21c1f40 53 API calls 11345->11346 11347 21c2b54 11346->11347 11348 21c2170 51 API calls 11347->11348 11352 21c2b8e 11347->11352 11349 21c2b68 11348->11349 11350 21c2300 69 API calls 11349->11350 11349->11352 11351 21c2b7b 11350->11351 11351->11352 11355 21c2480 52 API calls 11351->11355 11353 21c2600 58 API calls 11352->11353 11354 21c2bf3 11353->11354 11356 21c2910 51 API calls 11354->11356 11360 21c2c06 11354->11360 11355->11352 11356->11360 11357 21c2d20 61 API calls 11358 21c2caa 11357->11358 11358->11339 11359 21c30e0 62 API calls 11358->11359 11361 21c2cb8 11359->11361 11360->11357 11361->11339 11369 21c4c28 11362->11369 11365 21c4b10 44 API calls 11366 21c3a78 11365->11366 11367 21c11cc 11366->11367 11368 21c4b10 44 API calls 11366->11368 11368->11367 11370 21c3a6e 11369->11370 11373 21c4c52 __aulldiv __aullrem 11369->11373 11370->11365 11370->11366 11371 21c3ea7 29 API calls 11371->11373 11372 21c3dbe 29 API calls 11372->11373 11373->11370 11373->11371 11373->11372 11374 21c53dd 48 API calls 11373->11374 11375 21c540e 48 API calls 11373->11375 11376 21c888b 40 API calls 11373->11376 11377 21c53bd 48 API calls 11373->11377 11374->11373 11375->11373 11376->11373 11377->11373 10679 401f51 10680 401f63 10679->10680 10690 402004 10679->10690 10681 4029e8 18 API calls 10680->10681 10682 401f6a 10681->10682 10684 4029e8 18 API calls 10682->10684 10683 401423 25 API calls 10685 40215b 10683->10685 10686 401f73 10684->10686 10687 401f88 LoadLibraryExA 10686->10687 10688 401f7b GetModuleHandleA 10686->10688 10689 401f98 GetProcAddress 10687->10689 10687->10690 10688->10687 10688->10689 10691 401fe5 10689->10691 10692 401fa8 10689->10692 10690->10683 10693 404de1 25 API calls 10691->10693 10694 401fb0 10692->10694 10695 401fc7 10692->10695 10696 401fb8 10693->10696 10756 401423 10694->10756 10702 100042b0 10695->10702 10720 10004398 10695->10720 10745 100048b1 10695->10745 10696->10685 10698 401ff8 FreeLibrary 10696->10698 10698->10685 10759 10002cf0 10702->10759 10706 100042f4 10707 10002b98 2 API calls 10706->10707 10708 10004300 10707->10708 10769 100038ad 10708->10769 10712 1000433b RegCloseKey 10714 1000434f 10712->10714 10717 10004369 10712->10717 10791 100027c0 10714->10791 10715 1000437c 10718 10002c7b 3 API calls 10715->10718 10795 10002c7b 10717->10795 10719 10004395 10718->10719 10719->10696 10721 10002cf0 GetWindowsDirectoryW 10720->10721 10722 100043b2 10721->10722 10723 10002b98 2 API calls 10722->10723 10724 100043d7 10723->10724 10725 10002b98 2 API calls 10724->10725 10726 100043e2 10725->10726 10727 10002b98 2 API calls 10726->10727 10728 100043e9 10727->10728 10729 10002b98 2 API calls 10728->10729 10730 100043f5 10729->10730 10731 1000458f 10730->10731 10838 10003393 10730->10838 10733 10002c7b 3 API calls 10731->10733 10734 1000459a 10733->10734 10734->10696 10735 10004551 10737 1000358f 11 API calls 10735->10737 10736 10004440 10736->10731 10736->10735 10740 1000448b 10736->10740 10738 100044fa 10737->10738 10739 1000457c RegCloseKey 10738->10739 10739->10731 10741 1000449a 10740->10741 10742 100044d1 10740->10742 10853 1000358f 10741->10853 10742->10739 10744 1000358f 11 API calls 10742->10744 10744->10738 10746 10002cf0 GetWindowsDirectoryW 10745->10746 10747 100048ca 10746->10747 10748 10002b98 2 API calls 10747->10748 10749 100048e2 10748->10749 10750 10003393 7 API calls 10749->10750 10751 10004913 10750->10751 10752 1000491c RegCloseKey 10751->10752 10753 10004930 10751->10753 10752->10753 10754 10002c7b 3 API calls 10753->10754 10755 10004942 10754->10755 10755->10696 10757 404de1 25 API calls 10756->10757 10758 401431 10757->10758 10758->10696 10760 10002d4b 10759->10760 10761 10002d1e 10759->10761 10763 10002b98 10760->10763 10800 10002290 10761->10800 10764 10002c03 10763->10764 10765 10002ba4 10763->10765 10764->10706 10765->10764 10766 10002bb6 10765->10766 10767 10002bcb MultiByteToWideChar 10765->10767 10768 10002bed GlobalFree 10766->10768 10767->10766 10768->10706 10803 1000341e 10769->10803 10771 100038cf 10771->10717 10772 1000347f 10771->10772 10773 10003493 10772->10773 10774 10003567 10772->10774 10775 10002f8e 3 API calls 10773->10775 10776 10003585 10774->10776 10777 1000356b RegQueryValueExW 10774->10777 10778 1000349c RegQueryValueExA 10775->10778 10779 100022b7 MessageBoxW 10776->10779 10777->10712 10780 1000353f 10778->10780 10783 100034c4 10778->10783 10781 1000358a 10779->10781 10782 10002335 GlobalFree 10780->10782 10781->10712 10785 10003560 10782->10785 10784 100034ef 10783->10784 10787 100034d6 RegQueryValueExA 10783->10787 10784->10780 10786 100034f9 GlobalAlloc 10784->10786 10785->10712 10786->10780 10788 1000350b RegQueryValueExA 10786->10788 10787->10780 10829 1000237c 10788->10829 10792 10002825 10791->10792 10793 100027d9 10791->10793 10792->10717 10793->10792 10832 10001eaf 10793->10832 10796 10002c86 10795->10796 10799 10002cb0 10795->10799 10797 10002cb5 GlobalAlloc WideCharToMultiByte 10796->10797 10798 10002c8f GlobalAlloc 10796->10798 10797->10799 10798->10799 10799->10715 10801 100022b6 10800->10801 10802 1000229a GetWindowsDirectoryW 10800->10802 10801->10760 10802->10801 10804 1000345a 10803->10804 10805 1000342b 10803->10805 10806 10003475 10804->10806 10807 1000345e RegOpenKeyExW 10804->10807 10814 10002f8e 10805->10814 10820 100022b7 10806->10820 10807->10771 10823 100022dc 10814->10823 10817 10002335 10818 10002346 10817->10818 10819 1000233c GlobalFree 10817->10819 10818->10771 10819->10818 10821 100022c0 MessageBoxW 10820->10821 10822 100022db 10820->10822 10821->10822 10822->10771 10824 100022e8 WideCharToMultiByte 10823->10824 10825 1000232e RegOpenKeyExA 10823->10825 10824->10825 10826 10002304 GlobalAlloc 10824->10826 10825->10817 10826->10825 10827 10002312 WideCharToMultiByte 10826->10827 10828 10002326 10827->10828 10828->10825 10830 10002386 MultiByteToWideChar 10829->10830 10831 100023a0 GlobalFree 10829->10831 10830->10831 10831->10780 10833 10002276 10832->10833 10837 10001ed3 10832->10837 10833->10792 10834 100020ee lstrlenA 10834->10837 10835 1000210b lstrlenW 10835->10837 10836 1000214d MultiByteToWideChar 10836->10837 10837->10833 10837->10834 10837->10835 10837->10836 10839 100033a0 10838->10839 10840 100033ed 10838->10840 10841 10002f8e 3 API calls 10839->10841 10842 100033f1 RegCreateKeyExW 10840->10842 10843 10003414 10840->10843 10844 100033ab 10841->10844 10842->10736 10845 100022b7 MessageBoxW 10843->10845 10846 10002f8e 3 API calls 10844->10846 10847 10003419 10845->10847 10848 100033b5 RegCreateKeyExA 10846->10848 10847->10736 10849 10002335 GlobalFree 10848->10849 10850 100033de 10849->10850 10851 10002335 GlobalFree 10850->10851 10852 100033e4 10851->10852 10852->10736 10854 100035a5 10853->10854 10855 1000362e 10853->10855 10858 10002f8e 3 API calls 10854->10858 10856 10003632 RegSetValueExW 10855->10856 10857 1000364c 10855->10857 10869 10003627 10856->10869 10859 100022b7 MessageBoxW 10857->10859 10861 100035ae 10858->10861 10859->10869 10860 100035df GlobalAlloc 10862 100035f2 10860->10862 10863 1000361e 10860->10863 10861->10860 10864 100035c6 RegSetValueExA 10861->10864 10870 10002347 10862->10870 10866 1000361f 10863->10866 10864->10866 10868 10002335 GlobalFree 10866->10868 10868->10869 10869->10738 10871 10002354 WideCharToMultiByte 10870->10871 10872 10002370 RegSetValueExA GlobalFree 10870->10872 10871->10872 10872->10863 10953 21c4505 10955 21c4521 10953->10955 10957 21c4518 10953->10957 10955->10957 10960 21c4549 10955->10960 10961 21c442c 10955->10961 10956 21c4569 10959 21c442c 105 API calls 10956->10959 10956->10960 10957->10956 10958 21c442c 105 API calls 10957->10958 10957->10960 10958->10956 10959->10960 10962 21c4439 GetVersion 10961->10962 10963 21c44c1 10961->10963 10990 21c61f2 HeapCreate 10962->10990 10964 21c44c7 10963->10964 10965 21c44f3 10963->10965 10967 21c448c 10964->10967 10969 21c44e2 10964->10969 11088 21c4613 10964->11088 10965->10967 11091 21c7668 10965->11091 10967->10957 10968 21c444b 10968->10967 11002 21c757c 10968->11002 11049 21c7a1c 10969->11049 10974 21c4483 10976 21c4487 10974->10976 10977 21c4490 GetCommandLineA 10974->10977 11059 21c624f 10976->11059 11012 21c7d76 10977->11012 10983 21c624f 6 API calls 10983->10967 10985 21c44aa 11066 21c7b29 10985->11066 10987 21c44af 11075 21c7a70 10987->11075 10989 21c44b4 10989->10967 10991 21c6248 10990->10991 10992 21c6212 10990->10992 10991->10968 11113 21c60aa 10992->11113 10995 21c622e 10997 21c624b 10995->10997 11000 21c6e3e 5 API calls 10995->11000 10996 21c6221 11125 21c62f7 HeapAlloc 10996->11125 10997->10968 10999 21c622b 10999->10997 11001 21c623c HeapDestroy 10999->11001 11000->10999 11001->10991 11161 21c54d9 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 11002->11161 11004 21c7582 TlsAlloc 11005 21c75cc 11004->11005 11006 21c7592 11004->11006 11005->10974 11007 21c9681 30 API calls 11006->11007 11008 21c759b 11007->11008 11008->11005 11009 21c75a3 TlsSetValue 11008->11009 11009->11005 11010 21c75b4 11009->11010 11011 21c75ba GetCurrentThreadId 11010->11011 11011->10974 11013 21c7dc4 11012->11013 11014 21c7d91 GetEnvironmentStringsW 11012->11014 11015 21c7d99 11013->11015 11016 21c7db5 11013->11016 11014->11015 11017 21c7da5 GetEnvironmentStrings 11014->11017 11019 21c7ddd WideCharToMultiByte 11015->11019 11020 21c7dd1 GetEnvironmentStringsW 11015->11020 11018 21c44a0 11016->11018 11021 21c7e57 GetEnvironmentStrings 11016->11021 11022 21c7e63 11016->11022 11017->11016 11017->11018 11035 21c7860 11018->11035 11024 21c7e11 11019->11024 11025 21c7e43 FreeEnvironmentStringsW 11019->11025 11020->11018 11020->11019 11021->11018 11021->11022 11026 21c3ea7 29 API calls 11022->11026 11027 21c3ea7 29 API calls 11024->11027 11025->11018 11029 21c7e7e 11026->11029 11028 21c7e17 11027->11028 11028->11025 11030 21c7e20 WideCharToMultiByte 11028->11030 11031 21c7e94 FreeEnvironmentStringsA 11029->11031 11032 21c7e3a 11030->11032 11033 21c7e31 11030->11033 11031->11018 11032->11025 11034 21c3dbe 29 API calls 11033->11034 11034->11032 11036 21c3ea7 29 API calls 11035->11036 11037 21c7873 11036->11037 11038 21c7881 GetStartupInfoA 11037->11038 11039 21c45a2 7 API calls 11037->11039 11045 21c79a0 11038->11045 11048 21c78cf 11038->11048 11039->11038 11041 21c7a0b SetHandleCount 11041->10985 11042 21c79cb GetStdHandle 11044 21c79d9 GetFileType 11042->11044 11042->11045 11043 21c3ea7 29 API calls 11043->11048 11044->11045 11045->11041 11045->11042 11046 21c7946 11046->11045 11047 21c7968 GetFileType 11046->11047 11047->11046 11048->11043 11048->11045 11048->11046 11051 21c7a24 11049->11051 11050 21c44e7 11054 21c75d0 11050->11054 11051->11050 11052 21c3dbe 29 API calls 11051->11052 11053 21c7a3e DeleteCriticalSection 11051->11053 11052->11051 11053->11051 11162 21c5502 11054->11162 11056 21c75d5 11057 21c44ec 11056->11057 11058 21c75df TlsFree 11056->11058 11057->10983 11058->11057 11061 21c625b 11059->11061 11063 21c62c1 11059->11063 11060 21c62ad HeapFree 11062 21c62e8 HeapDestroy 11060->11062 11061->11060 11064 21c627b VirtualFree VirtualFree HeapFree 11061->11064 11062->10967 11063->11062 11065 21c62d4 VirtualFree 11063->11065 11064->11060 11064->11064 11065->11063 11067 21c7b3b 11066->11067 11068 21c7b40 GetModuleFileNameA 11066->11068 11167 21c9bad 11067->11167 11070 21c7b63 11068->11070 11071 21c3ea7 29 API calls 11070->11071 11072 21c7b84 11071->11072 11073 21c7b94 11072->11073 11074 21c45a2 7 API calls 11072->11074 11073->10987 11074->11073 11076 21c7a7d 11075->11076 11078 21c7a82 11075->11078 11077 21c9bad 48 API calls 11076->11077 11077->11078 11079 21c3ea7 29 API calls 11078->11079 11080 21c7aaf 11079->11080 11081 21c45a2 7 API calls 11080->11081 11087 21c7ac3 11080->11087 11081->11087 11082 21c7b06 11083 21c3dbe 29 API calls 11082->11083 11084 21c7b12 11083->11084 11084->10989 11085 21c3ea7 29 API calls 11085->11087 11086 21c45a2 7 API calls 11086->11087 11087->11082 11087->11085 11087->11086 11196 21c4622 11088->11196 11092 21c7676 11091->11092 11093 21c7707 11091->11093 11094 21c768c 11092->11094 11095 21c767f TlsGetValue 11092->11095 11093->10967 11097 21c7699 11094->11097 11098 21c3dbe 29 API calls 11094->11098 11095->11094 11096 21c76f8 TlsSetValue 11095->11096 11096->11093 11099 21c76a7 11097->11099 11100 21c3dbe 29 API calls 11097->11100 11098->11097 11101 21c76b5 11099->11101 11103 21c3dbe 29 API calls 11099->11103 11100->11099 11102 21c76c3 11101->11102 11104 21c3dbe 29 API calls 11101->11104 11105 21c76d1 11102->11105 11106 21c3dbe 29 API calls 11102->11106 11103->11101 11104->11102 11107 21c76df 11105->11107 11108 21c3dbe 29 API calls 11105->11108 11106->11105 11109 21c76f0 11107->11109 11111 21c3dbe 29 API calls 11107->11111 11108->11107 11110 21c3dbe 29 API calls 11109->11110 11112 21c76f7 11110->11112 11111->11109 11112->11096 11127 21c3ab0 11113->11127 11115 21c60b7 GetVersionExA 11116 21c60ed GetEnvironmentVariableA 11115->11116 11117 21c60d3 11115->11117 11118 21c61ca 11116->11118 11121 21c610c 11116->11121 11117->11116 11119 21c60e5 11117->11119 11118->11119 11132 21c607d GetModuleHandleA 11118->11132 11119->10995 11119->10996 11122 21c6151 GetModuleFileNameA 11121->11122 11123 21c6149 11121->11123 11122->11123 11123->11118 11129 21c8f5a 11123->11129 11126 21c6313 11125->11126 11126->10999 11128 21c3abc 11127->11128 11128->11115 11128->11128 11134 21c8f71 11129->11134 11133 21c6094 11132->11133 11133->11119 11136 21c8f89 11134->11136 11135 21c5464 6 API calls 11135->11136 11136->11135 11138 21c8fb9 11136->11138 11137 21c5464 6 API calls 11137->11138 11138->11137 11141 21c90e2 11138->11141 11142 21c8f6d 11138->11142 11143 21ca2e1 11138->11143 11140 21c9cc5 35 API calls 11140->11142 11141->11140 11141->11142 11142->11118 11144 21ca2ff InterlockedIncrement 11143->11144 11149 21ca2ec 11143->11149 11145 21ca325 11144->11145 11146 21ca31b InterlockedDecrement 11144->11146 11154 21ca350 11145->11154 11147 21c556e 29 API calls 11146->11147 11147->11145 11149->11138 11151 21ca33b 11160 21c55cf LeaveCriticalSection 11151->11160 11152 21ca345 InterlockedDecrement 11152->11149 11155 21ca37b 11154->11155 11159 21ca332 11154->11159 11156 21ca397 11155->11156 11157 21c5464 6 API calls 11155->11157 11158 21c55e4 9 API calls 11156->11158 11156->11159 11157->11156 11158->11159 11159->11151 11159->11152 11160->11149 11161->11004 11163 21c550f 11162->11163 11164 21c554b DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection DeleteCriticalSection 11163->11164 11165 21c5535 DeleteCriticalSection 11163->11165 11164->11056 11166 21c3dbe 29 API calls 11165->11166 11166->11163 11168 21c9bb6 11167->11168 11170 21c9bbd 11167->11170 11171 21c97d5 11168->11171 11170->11068 11172 21c556e 29 API calls 11171->11172 11173 21c97e5 11172->11173 11182 21c9982 11173->11182 11177 21c997a 11177->11170 11179 21c9821 GetCPInfo 11181 21c9837 11179->11181 11180 21c97fc 11195 21c55cf LeaveCriticalSection 11180->11195 11181->11180 11187 21c9a28 GetCPInfo 11181->11187 11183 21c99a2 11182->11183 11184 21c9992 GetOEMCP 11182->11184 11185 21c97ed 11183->11185 11186 21c99a7 GetACP 11183->11186 11184->11183 11185->11179 11185->11180 11185->11181 11186->11185 11188 21c9a4b 11187->11188 11194 21c9b13 11187->11194 11189 21c8b9e 6 API calls 11188->11189 11190 21c9ac7 11189->11190 11191 21c55e4 9 API calls 11190->11191 11192 21c9aeb 11191->11192 11193 21c55e4 9 API calls 11192->11193 11193->11194 11194->11180 11195->11177 11205 21c46c7 11196->11205 11199 21c4633 GetCurrentProcess TerminateProcess 11200 21c4644 11199->11200 11201 21c46ae 11200->11201 11202 21c46b5 ExitProcess 11200->11202 11208 21c46d0 11201->11208 11206 21c556e 29 API calls 11205->11206 11207 21c4628 11206->11207 11207->11199 11207->11200 11211 21c55cf LeaveCriticalSection 11208->11211 11210 21c461e 11210->10969 11211->11210 10651 40266e 10652 4029e8 18 API calls 10651->10652 10654 40267c 10652->10654 10653 402692 10656 4056fb 2 API calls 10653->10656 10654->10653 10655 4029e8 18 API calls 10654->10655 10655->10653 10657 402698 10656->10657 10677 40571a GetFileAttributesA CreateFileA 10657->10677 10659 4026a5 10660 4026b1 GlobalAlloc 10659->10660 10661 40274e 10659->10661 10662 402745 FindCloseChangeNotification 10660->10662 10663 4026ca 10660->10663 10664 402756 DeleteFileA 10661->10664 10665 402769 10661->10665 10662->10661 10678 4031da SetFilePointer 10663->10678 10664->10665 10667 4026d0 10668 4031a8 ReadFile 10667->10668 10669 4026d9 GlobalAlloc 10668->10669 10670 4026e9 10669->10670 10671 40271d WriteFile GlobalFree 10669->10671 10673 402f01 47 API calls 10670->10673 10672 402f01 47 API calls 10671->10672 10674 402742 10672->10674 10676 4026f6 10673->10676 10674->10662 10675 402714 GlobalFree 10675->10671 10676->10675 10677->10659 10678->10667 11662 40276f 11663 4029cb 18 API calls 11662->11663 11664 402775 11663->11664 11665 4027b0 11664->11665 11666 402799 11664->11666 11671 40264e 11664->11671 11669 4027c6 11665->11669 11670 4027ba 11665->11670 11667 4027ad 11666->11667 11668 40279e 11666->11668 11667->11671 11677 4059a1 wsprintfA 11667->11677 11676 405a43 lstrcpynA 11668->11676 11673 405a65 18 API calls 11669->11673 11672 4029cb 18 API calls 11670->11672 11672->11667 11673->11667 11676->11671 11677->11671 10194 401b06 10195 401b13 10194->10195 10196 401b57 10194->10196 10201 401b9b 10195->10201 10202 401b2a 10195->10202 10197 401b80 GlobalAlloc 10196->10197 10198 401b5b 10196->10198 10200 405a65 18 API calls 10197->10200 10208 402200 10198->10208 10215 405a43 lstrcpynA 10198->10215 10199 405a65 18 API calls 10203 4021fa 10199->10203 10200->10201 10201->10199 10201->10208 10213 405a43 lstrcpynA 10202->10213 10203->10208 10209 405304 MessageBoxIndirectA 10203->10209 10206 401b6d GlobalFree 10206->10208 10207 401b39 10214 405a43 lstrcpynA 10207->10214 10209->10208 10211 401b48 10216 405a43 lstrcpynA 10211->10216 10213->10207 10214->10211 10215->10206 10216->10208 9613 401721 9619 4029e8 9613->9619 9617 40172f 9618 405749 2 API calls 9617->9618 9618->9617 9620 4029f4 9619->9620 9629 405a65 9620->9629 9623 401728 9625 405749 9623->9625 9626 405754 GetTickCount GetTempFileNameA 9625->9626 9627 405780 9626->9627 9628 405784 9626->9628 9627->9626 9627->9628 9628->9617 9641 405a72 9629->9641 9630 405c88 9631 402a15 9630->9631 9663 405a43 lstrcpynA 9630->9663 9631->9623 9647 405ca1 9631->9647 9633 405b06 GetVersion 9633->9641 9634 405c5f lstrlenA 9634->9641 9637 405a65 10 API calls 9637->9634 9639 405b7e GetSystemDirectoryA 9639->9641 9640 405b91 GetWindowsDirectoryA 9640->9641 9641->9630 9641->9633 9641->9634 9641->9637 9641->9639 9641->9640 9642 405ca1 5 API calls 9641->9642 9643 405bc5 SHGetSpecialFolderLocation 9641->9643 9644 405a65 10 API calls 9641->9644 9645 405c08 lstrcatA 9641->9645 9656 40592a RegOpenKeyExA 9641->9656 9661 4059a1 wsprintfA 9641->9661 9662 405a43 lstrcpynA 9641->9662 9642->9641 9643->9641 9646 405bdd SHGetPathFromIDListA CoTaskMemFree 9643->9646 9644->9641 9645->9641 9646->9641 9648 405cad 9647->9648 9650 405d15 9648->9650 9651 405d0a CharNextA 9648->9651 9654 405cf8 CharNextA 9648->9654 9655 405d05 CharNextA 9648->9655 9664 405561 9648->9664 9649 405d19 CharPrevA 9649->9650 9650->9649 9652 405d34 9650->9652 9651->9648 9651->9650 9652->9623 9654->9648 9655->9651 9657 40599b 9656->9657 9658 40595d RegQueryValueExA 9656->9658 9657->9641 9659 40597e RegCloseKey 9658->9659 9659->9657 9661->9641 9662->9641 9663->9631 9665 405567 9664->9665 9666 40557a 9665->9666 9667 40556d CharNextA 9665->9667 9666->9648 9667->9665 9684 403225 #17 SetErrorMode OleInitialize 9754 405d61 GetModuleHandleA 9684->9754 9688 403293 GetCommandLineA 9759 405a43 lstrcpynA 9688->9759 9690 4032a5 GetModuleHandleA 9691 4032bc 9690->9691 9692 405561 CharNextA 9691->9692 9693 4032d0 CharNextA 9692->9693 9698 4032dd 9693->9698 9694 403346 9695 403359 GetTempPathA 9694->9695 9760 4031f1 9695->9760 9697 40336f 9699 403393 DeleteFileA 9697->9699 9700 403373 GetWindowsDirectoryA lstrcatA 9697->9700 9698->9694 9701 405561 CharNextA 9698->9701 9705 403348 9698->9705 9768 402c5b GetTickCount GetModuleFileNameA 9699->9768 9702 4031f1 11 API calls 9700->9702 9701->9698 9704 40338f 9702->9704 9704->9699 9708 403411 ExitProcess OleUninitialize 9704->9708 9853 405a43 lstrcpynA 9705->9853 9706 4033a4 9706->9708 9713 405561 CharNextA 9706->9713 9743 4033fd 9706->9743 9709 403426 9708->9709 9710 40350b 9708->9710 9870 405304 9709->9870 9711 40358e ExitProcess 9710->9711 9716 405d61 3 API calls 9710->9716 9719 4033bb 9713->9719 9720 40351a 9716->9720 9722 4033d8 9719->9722 9723 40343c lstrcatA lstrcmpiA 9719->9723 9721 405d61 3 API calls 9720->9721 9724 403523 9721->9724 9854 405617 9722->9854 9723->9708 9725 403458 CreateDirectoryA SetCurrentDirectoryA 9723->9725 9727 405d61 3 API calls 9724->9727 9728 40347a 9725->9728 9729 40346f 9725->9729 9731 40352c 9727->9731 9875 405a43 lstrcpynA 9728->9875 9874 405a43 lstrcpynA 9729->9874 9732 40357a ExitWindowsEx 9731->9732 9737 40353a GetCurrentProcess 9731->9737 9732->9711 9736 403587 9732->9736 9908 40140b 9736->9908 9742 40354a 9737->9742 9738 4033f2 9869 405a43 lstrcpynA 9738->9869 9741 405a65 18 API calls 9744 4034aa DeleteFileA 9741->9744 9742->9732 9798 4035e3 9743->9798 9745 4034b7 CopyFileA 9744->9745 9751 403488 9744->9751 9745->9751 9746 4034ff 9747 405791 39 API calls 9746->9747 9749 403506 9747->9749 9749->9708 9750 405a65 18 API calls 9750->9751 9751->9741 9751->9746 9751->9750 9753 4034eb CloseHandle 9751->9753 9876 405791 9751->9876 9905 4052a3 CreateProcessA 9751->9905 9753->9751 9755 405d88 GetProcAddress 9754->9755 9756 405d7d LoadLibraryA 9754->9756 9757 403268 SHGetFileInfoA 9755->9757 9756->9755 9756->9757 9758 405a43 lstrcpynA 9757->9758 9758->9688 9759->9690 9761 405ca1 5 API calls 9760->9761 9763 4031fd 9761->9763 9762 403207 9762->9697 9763->9762 9911 405536 lstrlenA CharPrevA 9763->9911 9766 405749 2 API calls 9767 403223 9766->9767 9767->9697 9914 40571a GetFileAttributesA CreateFileA 9768->9914 9770 402c9e 9797 402cab 9770->9797 9915 405a43 lstrcpynA 9770->9915 9772 402cc1 9916 40557d lstrlenA 9772->9916 9776 402cd2 GetFileSize 9777 402dd3 9776->9777 9795 402ce9 9776->9795 9923 402bc5 9777->9923 9781 402e16 GlobalAlloc 9785 402e2d 9781->9785 9782 402e6e 9783 402bc5 32 API calls 9782->9783 9783->9797 9789 405749 2 API calls 9785->9789 9786 402df7 9787 4031a8 ReadFile 9786->9787 9790 402e02 9787->9790 9788 402bc5 32 API calls 9788->9795 9791 402e3e CreateFileA 9789->9791 9790->9781 9790->9797 9792 402e78 9791->9792 9791->9797 9938 4031da SetFilePointer 9792->9938 9794 402e86 9939 402f01 9794->9939 9795->9777 9795->9782 9795->9788 9795->9797 9921 4031a8 ReadFile 9795->9921 9797->9706 9799 405d61 3 API calls 9798->9799 9800 4035f7 9799->9800 9801 4035fd 9800->9801 9802 40360f 9800->9802 10003 4059a1 wsprintfA 9801->10003 9803 40592a 3 API calls 9802->9803 9804 403630 9803->9804 9806 40364e lstrcatA 9804->9806 9808 40592a 3 API calls 9804->9808 9807 40360d 9806->9807 9994 403897 9807->9994 9808->9806 9811 405617 18 API calls 9812 403676 9811->9812 9813 4036ff 9812->9813 9815 40592a 3 API calls 9812->9815 9814 405617 18 API calls 9813->9814 9816 403705 9814->9816 9817 4036a2 9815->9817 9818 403715 LoadImageA 9816->9818 9819 405a65 18 API calls 9816->9819 9817->9813 9822 4036be lstrlenA 9817->9822 9826 405561 CharNextA 9817->9826 9820 403740 RegisterClassA 9818->9820 9821 4037c9 9818->9821 9819->9818 9823 40377c SystemParametersInfoA CreateWindowExA 9820->9823 9852 40340d 9820->9852 9824 40140b 2 API calls 9821->9824 9827 4036f2 9822->9827 9828 4036cc lstrcmpiA 9822->9828 9823->9821 9825 4037cf 9824->9825 9832 403897 19 API calls 9825->9832 9825->9852 9830 4036bc 9826->9830 9829 405536 3 API calls 9827->9829 9828->9827 9831 4036dc GetFileAttributesA 9828->9831 9833 4036f8 9829->9833 9830->9822 9834 4036e8 9831->9834 9836 4037e0 9832->9836 10004 405a43 lstrcpynA 9833->10004 9834->9827 9835 40557d 2 API calls 9834->9835 9835->9827 9838 403864 9836->9838 9839 4037e8 ShowWindow LoadLibraryA 9836->9839 10005 404eb3 OleInitialize 9838->10005 9840 403807 LoadLibraryA 9839->9840 9841 40380e GetClassInfoA 9839->9841 9840->9841 9843 403822 GetClassInfoA RegisterClassA 9841->9843 9844 403838 DialogBoxParamA 9841->9844 9843->9844 9846 40140b 2 API calls 9844->9846 9845 40386a 9847 403886 9845->9847 9848 40386e 9845->9848 9850 403860 9846->9850 9849 40140b 2 API calls 9847->9849 9851 40140b 2 API calls 9848->9851 9848->9852 9849->9852 9850->9852 9851->9852 9852->9708 9853->9695 10020 405a43 lstrcpynA 9854->10020 9856 405628 10021 4055ca CharNextA CharNextA 9856->10021 9859 4033e3 9859->9708 9868 405a43 lstrcpynA 9859->9868 9860 405ca1 5 API calls 9866 40563e 9860->9866 9861 405669 lstrlenA 9862 405674 9861->9862 9861->9866 9864 405536 3 API calls 9862->9864 9865 405679 GetFileAttributesA 9864->9865 9865->9859 9866->9859 9866->9861 9867 40557d 2 API calls 9866->9867 10027 405d3a FindFirstFileA 9866->10027 9867->9861 9868->9738 9869->9743 9871 405319 9870->9871 9872 403434 ExitProcess 9871->9872 9873 40532d MessageBoxIndirectA 9871->9873 9873->9872 9874->9728 9875->9751 9877 405d61 3 API calls 9876->9877 9878 40579c 9877->9878 9879 4057a4 MoveFileExA 9878->9879 9880 4057b5 9878->9880 9879->9880 9881 4058ee 9879->9881 9882 4057d3 9880->9882 9883 4057f9 GetShortPathNameA 9880->9883 9881->9751 10030 40571a GetFileAttributesA CreateFileA 9882->10030 9883->9881 9885 40580e 9883->9885 9885->9881 9886 405816 wsprintfA 9885->9886 9888 405a65 18 API calls 9886->9888 9887 4057dd CloseHandle GetShortPathNameA 9887->9881 9889 4057f1 9887->9889 9890 40583e 9888->9890 9889->9881 9889->9883 10031 40571a GetFileAttributesA CreateFileA 9890->10031 9892 40584b 9892->9881 9893 40585a GetFileSize GlobalAlloc 9892->9893 9894 4058e7 CloseHandle 9893->9894 9895 405878 ReadFile 9893->9895 9894->9881 9895->9894 9896 40588c 9895->9896 9896->9894 10032 40568f lstrlenA 9896->10032 9899 4058a1 10037 405a43 lstrcpynA 9899->10037 9900 4058fb 9901 40568f 4 API calls 9900->9901 9903 4058af 9901->9903 9904 4058c2 SetFilePointer WriteFile GlobalFree 9903->9904 9904->9894 9906 4052d2 CloseHandle 9905->9906 9907 4052de 9905->9907 9906->9907 9907->9751 9909 401389 2 API calls 9908->9909 9910 401420 9909->9910 9910->9711 9912 405550 lstrcatA 9911->9912 9913 40320f CreateDirectoryA 9911->9913 9912->9913 9913->9766 9914->9770 9915->9772 9917 40558a 9916->9917 9918 402cc7 9917->9918 9919 40558f CharPrevA 9917->9919 9920 405a43 lstrcpynA 9918->9920 9919->9917 9919->9918 9920->9776 9922 4031c9 9921->9922 9922->9795 9924 402bd3 9923->9924 9925 402beb 9923->9925 9926 402bdc DestroyWindow 9924->9926 9929 402be3 9924->9929 9927 402bf3 9925->9927 9928 402bfb GetTickCount 9925->9928 9926->9929 9955 405d9a 9927->9955 9928->9929 9930 402c09 9928->9930 9929->9781 9929->9797 9954 4031da SetFilePointer 9929->9954 9932 402c11 9930->9932 9933 402c3e CreateDialogParamA 9930->9933 9932->9929 9959 402ba9 9932->9959 9933->9929 9935 402c1f wsprintfA 9962 404de1 9935->9962 9938->9794 9940 402f12 SetFilePointer 9939->9940 9941 402f2e 9939->9941 9940->9941 9973 40302c GetTickCount 9941->9973 9944 402f3f ReadFile 9945 402f5f 9944->9945 9953 402feb 9944->9953 9946 40302c 42 API calls 9945->9946 9945->9953 9947 402f76 9946->9947 9948 402ff1 ReadFile 9947->9948 9951 402f86 9947->9951 9947->9953 9948->9953 9950 402fa1 ReadFile 9950->9951 9950->9953 9951->9950 9952 402fba WriteFile 9951->9952 9951->9953 9952->9951 9952->9953 9953->9797 9954->9786 9956 405db7 PeekMessageA 9955->9956 9957 405dc7 9956->9957 9958 405dad DispatchMessageA 9956->9958 9957->9929 9958->9956 9960 402bb8 9959->9960 9961 402bba MulDiv 9959->9961 9960->9961 9961->9935 9963 404dfc 9962->9963 9972 402c3c 9962->9972 9964 404e19 lstrlenA 9963->9964 9965 405a65 18 API calls 9963->9965 9966 404e42 9964->9966 9967 404e27 lstrlenA 9964->9967 9965->9964 9969 404e55 9966->9969 9970 404e48 SetWindowTextA 9966->9970 9968 404e39 lstrcatA 9967->9968 9967->9972 9968->9966 9971 404e5b SendMessageA SendMessageA SendMessageA 9969->9971 9969->9972 9970->9969 9971->9972 9972->9929 9974 403196 9973->9974 9975 40305b 9973->9975 9976 402bc5 32 API calls 9974->9976 9986 4031da SetFilePointer 9975->9986 9982 402f37 9976->9982 9978 403066 SetFilePointer 9983 40308b 9978->9983 9979 4031a8 ReadFile 9979->9983 9981 402bc5 32 API calls 9981->9983 9982->9944 9982->9953 9983->9979 9983->9981 9983->9982 9984 403120 WriteFile 9983->9984 9985 403177 SetFilePointer 9983->9985 9987 405e5b 9983->9987 9984->9982 9984->9983 9985->9974 9986->9978 9988 405e80 9987->9988 9989 405e88 9987->9989 9988->9983 9989->9988 9990 405f18 GlobalAlloc 9989->9990 9991 405f0f GlobalFree 9989->9991 9992 405f86 GlobalFree 9989->9992 9993 405f8f GlobalAlloc 9989->9993 9990->9988 9990->9989 9991->9990 9992->9993 9993->9988 9993->9989 9995 4038ab 9994->9995 10012 4059a1 wsprintfA 9995->10012 9997 40391c 9998 405a65 18 API calls 9997->9998 9999 403928 SetWindowTextA 9998->9999 10000 403944 9999->10000 10001 40365e 9999->10001 10000->10001 10002 405a65 18 API calls 10000->10002 10001->9811 10002->10000 10003->9807 10004->9813 10013 403e83 10005->10013 10007 404ed6 10011 404efd 10007->10011 10016 401389 10007->10016 10008 403e83 SendMessageA 10009 404f0f OleUninitialize 10008->10009 10009->9845 10011->10008 10012->9997 10014 403e9b 10013->10014 10015 403e8c SendMessageA 10013->10015 10014->10007 10015->10014 10018 401390 10016->10018 10017 4013fe 10017->10007 10018->10017 10019 4013cb MulDiv SendMessageA 10018->10019 10019->10018 10020->9856 10022 4055e4 10021->10022 10026 4055f0 10021->10026 10023 4055eb CharNextA 10022->10023 10022->10026 10024 40560d 10023->10024 10024->9859 10024->9860 10025 405561 CharNextA 10025->10026 10026->10024 10026->10025 10028 405d50 FindClose 10027->10028 10029 405d5b 10027->10029 10028->10029 10029->9866 10030->9887 10031->9892 10033 4056c5 lstrlenA 10032->10033 10034 4056a3 lstrcmpiA 10033->10034 10035 4056cf 10033->10035 10034->10035 10036 4056bc CharNextA 10034->10036 10035->9899 10035->9900 10036->10033 10037->9903 12303 404d31 12304 404d56 12303->12304 12305 404d3f 12303->12305 12308 404d64 IsWindowVisible 12304->12308 12314 404d7b 12304->12314 12306 404dbf 12305->12306 12307 404d45 12305->12307 12310 404dc5 CallWindowProcA 12306->12310 12309 403e83 SendMessageA 12307->12309 12308->12306 12311 404d71 12308->12311 12312 404d4f 12309->12312 12310->12312 12313 4046b0 5 API calls 12311->12313 12313->12314 12314->12310 12322 405a43 lstrcpynA 12314->12322 12316 404daa 12323 4059a1 wsprintfA 12316->12323 12318 404db1 12319 40140b 2 API calls 12318->12319 12320 404db8 12319->12320 12324 405a43 lstrcpynA 12320->12324 12322->12316 12323->12318 12324->12306 10892 401734 10893 4029e8 18 API calls 10892->10893 10894 40173b 10893->10894 10895 401761 10894->10895 10896 401759 10894->10896 10932 405a43 lstrcpynA 10895->10932 10931 405a43 lstrcpynA 10896->10931 10899 40175f 10903 405ca1 5 API calls 10899->10903 10900 40176c 10901 405536 3 API calls 10900->10901 10902 401772 lstrcatA 10901->10902 10902->10899 10922 40177e 10903->10922 10904 405d3a 2 API calls 10904->10922 10905 4056fb 2 API calls 10905->10922 10907 401795 CompareFileTime 10907->10922 10908 401859 10909 404de1 25 API calls 10908->10909 10912 401863 10909->10912 10910 404de1 25 API calls 10918 401845 10910->10918 10911 405a43 lstrcpynA 10911->10922 10913 402f01 47 API calls 10912->10913 10914 401876 10913->10914 10915 40188a SetFileTime 10914->10915 10916 40189c FindCloseChangeNotification 10914->10916 10915->10916 10916->10918 10919 4018ad 10916->10919 10917 405a65 18 API calls 10917->10922 10920 4018b2 10919->10920 10921 4018c5 10919->10921 10923 405a65 18 API calls 10920->10923 10924 405a65 18 API calls 10921->10924 10922->10904 10922->10905 10922->10907 10922->10908 10922->10911 10922->10917 10925 405304 MessageBoxIndirectA 10922->10925 10928 401830 10922->10928 10930 40571a GetFileAttributesA CreateFileA 10922->10930 10926 4018ba lstrcatA 10923->10926 10927 4018cd 10924->10927 10925->10922 10926->10927 10927->10918 10929 405304 MessageBoxIndirectA 10927->10929 10928->10910 10928->10918 10929->10918 10930->10922 10931->10899 10932->10900 12325 401934 12326 4029cb 18 API calls 12325->12326 12327 40193b 12326->12327 12328 4029cb 18 API calls 12327->12328 12329 401945 12328->12329 12330 4029e8 18 API calls 12329->12330 12331 40194e 12330->12331 12332 401961 lstrlenA 12331->12332 12333 40199c 12331->12333 12334 40196b 12332->12334 12334->12333 12338 405a43 lstrcpynA 12334->12338 12336 401985 12336->12333 12337 401992 lstrlenA 12336->12337 12337->12333 12338->12336 12465 4018d8 12466 40190f 12465->12466 12467 4029e8 18 API calls 12466->12467 12468 401914 12467->12468 12469 405368 69 API calls 12468->12469 12470 40191d 12469->12470 10038 21c3eb9 10039 21c3ee2 10038->10039 10041 21c3ec0 10038->10041 10041->10039 10042 21c3ee5 10041->10042 10043 21c3f55 10042->10043 10045 21c3f12 10042->10045 10044 21c3f40 10043->10044 10050 21c3f77 10043->10050 10047 21c3fc4 RtlAllocateHeap 10044->10047 10049 21c3f47 10044->10049 10045->10044 10060 21c556e 10045->10060 10047->10049 10048 21c3f28 10075 21c6693 10048->10075 10049->10041 10052 21c556e 28 API calls 10050->10052 10054 21c3f7e 10052->10054 10084 21c7136 10054->10084 10057 21c3f91 10091 21c3fab 10057->10091 10061 21c55c4 EnterCriticalSection 10060->10061 10062 21c5586 10060->10062 10061->10048 10094 21c3ea7 10062->10094 10065 21c559c 10066 21c556e 27 API calls 10065->10066 10068 21c55a4 10066->10068 10069 21c55ab InitializeCriticalSection 10068->10069 10070 21c55b5 10068->10070 10071 21c55ba 10069->10071 10103 21c3dbe 10070->10103 10120 21c55cf LeaveCriticalSection 10071->10120 10074 21c55c2 10074->10061 10078 21c66c5 10075->10078 10076 21c6764 10080 21c3f33 10076->10080 10179 21c6a4d 10076->10179 10078->10076 10078->10080 10172 21c699c 10078->10172 10081 21c3f4c 10080->10081 10183 21c55cf LeaveCriticalSection 10081->10183 10083 21c3f53 10083->10044 10085 21c7144 10084->10085 10086 21c7305 10085->10086 10087 21c7230 VirtualAlloc 10085->10087 10090 21c7201 10085->10090 10184 21c6e3e 10086->10184 10087->10090 10090->10057 10193 21c55cf LeaveCriticalSection 10091->10193 10093 21c3f9e 10093->10044 10093->10049 10121 21c3eb9 10094->10121 10097 21c45a2 10098 21c45ac 10097->10098 10099 21c45be 10098->10099 10125 21c7ea8 10098->10125 10131 21c7ee1 10099->10131 10104 21c3dec 10103->10104 10105 21c3e98 10103->10105 10106 21c3df6 10104->10106 10107 21c3e31 10104->10107 10105->10071 10108 21c556e 28 API calls 10106->10108 10109 21c3e22 10107->10109 10111 21c556e 28 API calls 10107->10111 10113 21c3dfd 10108->10113 10109->10105 10110 21c3e8a HeapFree 10109->10110 10110->10105 10114 21c3e3d 10111->10114 10112 21c3e17 10151 21c3e28 10112->10151 10113->10112 10145 21c636a 10113->10145 10119 21c3e69 10114->10119 10154 21c70f1 10114->10154 10158 21c3e80 10119->10158 10120->10074 10122 21c3eb6 10121->10122 10124 21c3ec0 10121->10124 10122->10065 10122->10097 10123 21c3ee5 29 API calls 10123->10124 10124->10122 10124->10123 10126 21c7eb2 10125->10126 10127 21c7edf 10126->10127 10128 21c7ee1 7 API calls 10126->10128 10127->10099 10129 21c7ec9 10128->10129 10130 21c7ee1 7 API calls 10129->10130 10130->10127 10134 21c7ef4 10131->10134 10132 21c45c7 10132->10065 10133 21c800b 10137 21c801e GetStdHandle WriteFile 10133->10137 10134->10132 10134->10133 10135 21c7f34 10134->10135 10135->10132 10136 21c7f40 GetModuleFileNameA 10135->10136 10138 21c7f58 10136->10138 10137->10132 10140 21c9bc9 10138->10140 10141 21c9bd6 LoadLibraryA 10140->10141 10143 21c9c18 10140->10143 10142 21c9be7 GetProcAddress 10141->10142 10141->10143 10142->10143 10144 21c9bfe GetProcAddress GetProcAddress 10142->10144 10143->10132 10144->10143 10146 21c63a8 10145->10146 10150 21c665e 10145->10150 10147 21c65a4 VirtualFree 10146->10147 10146->10150 10148 21c6608 10147->10148 10149 21c6617 VirtualFree HeapFree 10148->10149 10148->10150 10149->10150 10150->10112 10161 21c55cf LeaveCriticalSection 10151->10161 10153 21c3e2f 10153->10109 10155 21c711e 10154->10155 10156 21c7134 10154->10156 10155->10156 10162 21c6fd8 10155->10162 10156->10119 10171 21c55cf LeaveCriticalSection 10158->10171 10160 21c3e87 10160->10109 10161->10153 10164 21c6fe5 10162->10164 10163 21c7095 10163->10156 10164->10163 10165 21c7006 VirtualFree 10164->10165 10167 21c6f82 VirtualFree 10164->10167 10165->10164 10168 21c6f9f 10167->10168 10169 21c6fcf 10168->10169 10170 21c6faf HeapFree 10168->10170 10169->10164 10170->10164 10171->10160 10173 21c69df HeapAlloc 10172->10173 10174 21c69af HeapReAlloc 10172->10174 10176 21c6a2f 10173->10176 10177 21c6a05 VirtualAlloc 10173->10177 10175 21c69ce 10174->10175 10174->10176 10175->10173 10176->10076 10177->10176 10178 21c6a1f HeapFree 10177->10178 10178->10176 10180 21c6a5f VirtualAlloc 10179->10180 10182 21c6aa8 10180->10182 10182->10080 10183->10083 10185 21c6e4b 10184->10185 10186 21c6e52 HeapAlloc 10184->10186 10187 21c6e6f VirtualAlloc 10185->10187 10186->10187 10192 21c6ea7 10186->10192 10188 21c6e8f VirtualAlloc 10187->10188 10189 21c6f64 10187->10189 10190 21c6f56 VirtualFree 10188->10190 10188->10192 10191 21c6f6c HeapFree 10189->10191 10189->10192 10190->10189 10191->10192 10192->10090 10193->10093 10933 4022f5 10934 4022fb 10933->10934 10935 4029e8 18 API calls 10934->10935 10936 40230d 10935->10936 10937 4029e8 18 API calls 10936->10937 10938 402317 RegCreateKeyExA 10937->10938 10939 402341 10938->10939 10940 40287d 10938->10940 10941 402359 10939->10941 10942 4029e8 18 API calls 10939->10942 10948 402365 10941->10948 10950 4029cb 10941->10950 10944 402352 lstrlenA 10942->10944 10943 402380 RegSetValueExA 10947 402396 RegCloseKey 10943->10947 10944->10941 10946 402f01 47 API calls 10946->10943 10947->10940 10948->10943 10948->10946 10951 405a65 18 API calls 10950->10951 10952 4029df 10951->10952 10952->10948 12686 4027f5 12687 4029cb 18 API calls 12686->12687 12688 4027fb 12687->12688 12689 40282c 12688->12689 12690 40264e 12688->12690 12692 402809 12688->12692 12689->12690 12691 405a65 18 API calls 12689->12691 12691->12690 12692->12690 12694 4059a1 wsprintfA 12692->12694 12694->12690 10267 401389 10269 401390 10267->10269 10268 4013fe 10269->10268 10270 4013cb MulDiv SendMessageA 10269->10270 10270->10269 12801 40248e 12802 4029e8 18 API calls 12801->12802 12803 402495 12802->12803 12806 40571a GetFileAttributesA CreateFileA 12803->12806 12805 4024a1 12806->12805 12843 401e95 12844 4029e8 18 API calls 12843->12844 12845 401e9c 12844->12845 12846 405d3a 2 API calls 12845->12846 12847 401ea2 12846->12847 12849 401eb4 12847->12849 12850 4059a1 wsprintfA 12847->12850 12850->12849 12877 401696 12878 4029e8 18 API calls 12877->12878 12879 40169c GetFullPathNameA 12878->12879 12880 4016d4 12879->12880 12881 4016b3 12879->12881 12882 4016e8 GetShortPathNameA 12880->12882 12883 40287d 12880->12883 12881->12880 12884 405d3a 2 API calls 12881->12884 12882->12883 12885 4016c4 12884->12885 12885->12880 12887 405a43 lstrcpynA 12885->12887 12887->12880 11212 402299 11213 4022c9 11212->11213 11214 40229e 11212->11214 11216 4029e8 18 API calls 11213->11216 11215 402af2 19 API calls 11214->11215 11217 4022a5 11215->11217 11218 4022d0 11216->11218 11219 4029e8 18 API calls 11217->11219 11222 4022e6 11217->11222 11223 402a28 RegOpenKeyExA 11218->11223 11220 4022b6 RegDeleteValueA RegCloseKey 11219->11220 11220->11222 11224 402a53 11223->11224 11225 402abc 11223->11225 11226 402a79 RegEnumKeyA 11224->11226 11227 402a8b RegCloseKey 11224->11227 11229 402ab0 RegCloseKey 11224->11229 11232 402a28 3 API calls 11224->11232 11225->11222 11226->11224 11226->11227 11228 405d61 3 API calls 11227->11228 11230 402a9b 11228->11230 11231 402a9f 11229->11231 11230->11231 11233 402acb RegDeleteKeyA 11230->11233 11231->11225 11232->11224 11233->11231 9668 4023a1 9679 402af2 9668->9679 9670 4023ab 9671 4029e8 18 API calls 9670->9671 9672 4023b4 9671->9672 9673 4023be RegQueryValueExA 9672->9673 9676 40264e 9672->9676 9674 4023e4 RegCloseKey 9673->9674 9675 4023de 9673->9675 9674->9676 9675->9674 9683 4059a1 wsprintfA 9675->9683 9680 4029e8 18 API calls 9679->9680 9681 402b0b 9680->9681 9682 402b19 RegOpenKeyExA 9681->9682 9682->9670 9683->9674 10217 4035a6 10218 4035c1 10217->10218 10219 4035b7 CloseHandle 10217->10219 10220 4035d5 10218->10220 10221 4035cb CloseHandle 10218->10221 10219->10218 10224 405368 10220->10224 10221->10220 10225 405617 18 API calls 10224->10225 10226 40537c 10225->10226 10227 405385 DeleteFileA 10226->10227 10228 40539c 10226->10228 10257 4035e1 10227->10257 10231 4054d1 10228->10231 10262 405a43 lstrcpynA 10228->10262 10230 4053c6 10232 4053d7 10230->10232 10233 4053ca lstrcatA 10230->10233 10234 405d3a 2 API calls 10231->10234 10231->10257 10235 40557d 2 API calls 10232->10235 10236 4053dd 10233->10236 10238 4054f6 10234->10238 10235->10236 10237 4053eb lstrcatA 10236->10237 10239 4053f6 lstrlenA FindFirstFileA 10236->10239 10237->10239 10240 405536 3 API calls 10238->10240 10238->10257 10239->10231 10260 40541a 10239->10260 10242 405500 10240->10242 10241 405561 CharNextA 10241->10260 10243 4056fb 2 API calls 10242->10243 10244 405506 RemoveDirectoryA 10243->10244 10245 405511 10244->10245 10246 405528 10244->10246 10251 404de1 25 API calls 10245->10251 10245->10257 10247 404de1 25 API calls 10246->10247 10247->10257 10248 4054b0 FindNextFileA 10250 4054c8 FindClose 10248->10250 10248->10260 10250->10231 10252 40551f 10251->10252 10254 405791 39 API calls 10252->10254 10254->10257 10256 405368 60 API calls 10256->10260 10258 404de1 25 API calls 10258->10248 10259 404de1 25 API calls 10259->10260 10260->10241 10260->10248 10260->10256 10260->10258 10260->10259 10261 405791 39 API calls 10260->10261 10263 405a43 lstrcpynA 10260->10263 10264 4056fb GetFileAttributesA 10260->10264 10261->10260 10262->10230 10263->10260 10265 40547d DeleteFileA 10264->10265 10266 40570a SetFileAttributesA 10264->10266 10265->10260 10266->10265 10271 21c2af0 10273 21c2afa 10271->10273 10272 21c2cbb 10273->10272 10295 21c2f10 10273->10295 10276 21c2b2d 10302 21c2a40 10276->10302 10285 21c2b8e 10341 21c2600 10285->10341 10293 21c2c06 10361 21c2d20 10293->10361 10294 21c2cb8 10294->10272 10296 21c2f29 10295->10296 10301 21c2b22 10295->10301 10297 21c2f39 SHGetValueA 10296->10297 10296->10301 10298 21c2f88 10297->10298 10297->10301 10299 21c2d20 61 API calls 10298->10299 10298->10301 10300 21c302e lstrcmpiA 10299->10300 10300->10301 10301->10272 10301->10276 10303 21c2aaf 10302->10303 10304 21c2ad4 10303->10304 10375 21c2100 10303->10375 10306 21c1f40 10304->10306 10307 21c20dc 10306->10307 10314 21c1f56 10306->10314 10307->10285 10315 21c2170 10307->10315 10308 21c2100 48 API calls 10309 21c1f80 CreateFileA 10308->10309 10310 21c1fa8 DeviceIoControl 10309->10310 10309->10314 10311 21c1fde CloseHandle 10310->10311 10310->10314 10311->10314 10312 21c20bc CloseHandle 10312->10307 10312->10314 10314->10307 10314->10308 10314->10312 10540 21c1380 DeviceIoControl 10314->10540 10316 21c2184 10315->10316 10317 21c2100 48 API calls 10316->10317 10319 21c22ef 10316->10319 10320 21c2208 DeviceIoControl 10316->10320 10321 21c22d6 CloseHandle 10316->10321 10318 21c219c CreateFileA 10317->10318 10318->10316 10319->10285 10322 21c2300 10319->10322 10320->10316 10321->10316 10323 21c230a 10322->10323 10324 21c2100 48 API calls 10323->10324 10327 21c245b 10323->10327 10328 21c2435 CloseHandle 10323->10328 10541 21c1200 10323->10541 10325 21c234d CreateFileA 10324->10325 10325->10323 10326 21c236e DeviceIoControl 10325->10326 10326->10323 10326->10328 10327->10285 10330 21c2480 10327->10330 10328->10323 10328->10327 10339 21c2496 10330->10339 10331 21c2100 48 API calls 10332 21c24ab CreateFileA 10331->10332 10333 21c24d3 DeviceIoControl 10332->10333 10332->10339 10333->10339 10334 21c25f2 10334->10285 10335 21c3ea7 29 API calls 10336 21c2519 DeviceIoControl 10335->10336 10337 21c25cc CloseHandle 10336->10337 10340 21c254a 10336->10340 10338 21c3dbe 29 API calls 10337->10338 10338->10339 10339->10331 10339->10334 10339->10335 10340->10337 10342 21c2614 10341->10342 10347 21c2786 10341->10347 10343 21c2623 RegOpenKeyExA 10342->10343 10342->10347 10343->10347 10352 21c2651 10343->10352 10344 21c2662 RegEnumKeyExA 10345 21c2772 RegCloseKey 10344->10345 10346 21c2693 RegOpenKeyExA 10344->10346 10345->10347 10348 21c26b6 RegQueryValueExA 10346->10348 10346->10352 10347->10293 10353 21c2910 Netbios 10347->10353 10349 21c275e RegCloseKey 10348->10349 10348->10352 10349->10352 10351 21c271a lstrcmpA 10351->10349 10351->10352 10352->10344 10352->10349 10352->10351 10612 21c2800 10352->10612 10354 21c294a Netbios 10353->10354 10355 21c2a35 10353->10355 10356 21c29a0 Netbios 10354->10356 10355->10293 10356->10355 10358 21c29d6 10356->10358 10359 21c2100 48 API calls 10358->10359 10360 21c2a21 10359->10360 10360->10293 10362 21c2d55 10361->10362 10363 21c2100 48 API calls 10362->10363 10365 21c2d77 10363->10365 10364 21c2100 48 API calls 10364->10365 10365->10364 10366 21c2e8d 10365->10366 10367 21c2caa 10366->10367 10368 21c2100 48 API calls 10366->10368 10367->10272 10371 21c30e0 10367->10371 10369 21c2ec5 10368->10369 10621 21c41b4 10369->10621 10372 21c2d20 61 API calls 10371->10372 10373 21c310c SHSetValueA 10372->10373 10373->10294 10376 21c210b 10375->10376 10377 21c2111 10375->10377 10376->10304 10378 21c211a 10377->10378 10381 21c3c6f 10377->10381 10378->10304 10386 21c5833 10381->10386 10384 21c213d 10384->10304 10387 21c3c9b 10386->10387 10389 21c585b __aulldiv __aullrem 10386->10389 10387->10384 10395 21c4b10 10387->10395 10388 21c5fd1 44 API calls 10388->10389 10389->10387 10389->10388 10390 21c3ea7 29 API calls 10389->10390 10391 21c8e98 39 API calls 10389->10391 10392 21c3dbe 29 API calls 10389->10392 10393 21c6037 44 API calls 10389->10393 10394 21c6006 44 API calls 10389->10394 10390->10389 10391->10389 10392->10389 10393->10389 10394->10389 10396 21c4baa 10395->10396 10397 21c4b26 10395->10397 10396->10384 10397->10396 10404 21c4b81 10397->10404 10407 21c863d 10397->10407 10398 21c4b8b 10401 21c4ba2 10398->10401 10405 21c4bb2 10398->10405 10399 21c4bf2 10400 21c844d 44 API calls 10399->10400 10400->10396 10410 21c844d 10401->10410 10404->10398 10404->10399 10405->10396 10424 21c8375 10405->10424 10408 21c3ea7 29 API calls 10407->10408 10409 21c864d 10408->10409 10409->10404 10411 21c849a 10410->10411 10412 21c845a 10410->10412 10470 21c9cc5 10411->10470 10412->10411 10413 21c8475 10412->10413 10438 21c9d98 10413->10438 10418 21c847c 10447 21c84b2 10418->10447 10423 21c8492 10423->10396 10425 21c83c2 10424->10425 10426 21c8382 10424->10426 10427 21c9cc5 35 API calls 10425->10427 10426->10425 10428 21c839d 10426->10428 10429 21c83c7 10427->10429 10430 21c9d98 31 API calls 10428->10430 10431 21c9cce 35 API calls 10429->10431 10432 21c83a4 10430->10432 10433 21c83d2 10431->10433 10434 21c83da 37 API calls 10432->10434 10433->10396 10435 21c83b2 10434->10435 10539 21c9df7 LeaveCriticalSection 10435->10539 10437 21c83ba 10437->10396 10439 21c9de6 EnterCriticalSection 10438->10439 10440 21c9dc3 10438->10440 10439->10418 10441 21c556e 29 API calls 10440->10441 10442 21c9dca 10441->10442 10443 21c9dde 10442->10443 10444 21c9dd1 InitializeCriticalSection 10442->10444 10476 21c55cf LeaveCriticalSection 10443->10476 10444->10443 10446 21c9de5 10446->10439 10448 21c84d2 10447->10448 10465 21c848a 10447->10465 10451 21c84ff 10448->10451 10477 21c83da 10448->10477 10450 21c85d1 WriteFile 10453 21c8598 10450->10453 10454 21c85f3 GetLastError 10450->10454 10451->10450 10457 21c8510 10451->10457 10452 21c860c 10455 21c9cc5 35 API calls 10452->10455 10452->10465 10453->10452 10458 21c85aa 10453->10458 10453->10465 10454->10453 10459 21c8626 10455->10459 10456 21c855c WriteFile 10456->10457 10460 21c85c6 GetLastError 10456->10460 10457->10452 10457->10453 10457->10456 10461 21c85fe 10458->10461 10462 21c85b2 10458->10462 10463 21c9cce 35 API calls 10459->10463 10460->10453 10487 21c9c52 10461->10487 10464 21c9cc5 35 API calls 10462->10464 10463->10465 10467 21c85b7 10464->10467 10469 21c9df7 LeaveCriticalSection 10465->10469 10468 21c9cce 35 API calls 10467->10468 10468->10465 10469->10423 10511 21c7601 GetLastError TlsGetValue 10470->10511 10472 21c849f 10473 21c9cce 10472->10473 10474 21c7601 35 API calls 10473->10474 10475 21c84aa 10474->10475 10475->10396 10476->10446 10504 21c9d56 10477->10504 10479 21c83e6 10480 21c83ec 10479->10480 10481 21c83f9 SetFilePointer 10479->10481 10482 21c9cc5 35 API calls 10480->10482 10483 21c8419 10481->10483 10484 21c8411 GetLastError 10481->10484 10485 21c83f1 10482->10485 10483->10485 10486 21c9c52 35 API calls 10483->10486 10484->10483 10485->10451 10486->10485 10488 21c9cce 35 API calls 10487->10488 10489 21c9c58 10488->10489 10490 21c9c8b 10489->10490 10491 21c9c74 10489->10491 10492 21c9cc5 35 API calls 10490->10492 10493 21c9c9b 10491->10493 10495 21c9c7e 10491->10495 10494 21c9c90 10492->10494 10496 21c9cb8 10493->10496 10499 21c9cab 10493->10499 10494->10465 10498 21c9cc5 35 API calls 10495->10498 10497 21c9cc5 35 API calls 10496->10497 10500 21c9cbd 10497->10500 10501 21c9c83 10498->10501 10502 21c9cc5 35 API calls 10499->10502 10500->10465 10501->10465 10503 21c9cb0 10502->10503 10503->10465 10505 21c9d62 10504->10505 10506 21c9d7e 10505->10506 10507 21c9cc5 35 API calls 10505->10507 10506->10479 10508 21c9d86 10507->10508 10509 21c9cce 35 API calls 10508->10509 10510 21c9d91 10509->10510 10510->10479 10512 21c765c SetLastError 10511->10512 10513 21c761d 10511->10513 10512->10472 10522 21c9681 10513->10522 10516 21c762e TlsSetValue 10517 21c7654 10516->10517 10518 21c763f 10516->10518 10519 21c45a2 7 API calls 10517->10519 10521 21c7645 GetCurrentThreadId 10518->10521 10520 21c765b 10519->10520 10520->10512 10521->10512 10530 21c96b6 10522->10530 10523 21c7626 10523->10516 10523->10517 10524 21c556e 29 API calls 10524->10530 10525 21c976e HeapAlloc 10525->10530 10526 21c6693 5 API calls 10526->10530 10527 21c7136 6 API calls 10527->10530 10530->10523 10530->10524 10530->10525 10530->10526 10530->10527 10531 21c971a 10530->10531 10534 21c97a3 10530->10534 10537 21c55cf LeaveCriticalSection 10531->10537 10533 21c9721 10533->10530 10538 21c55cf LeaveCriticalSection 10534->10538 10536 21c97aa 10536->10530 10537->10533 10538->10536 10539->10437 10540->10314 10542 21c1210 10541->10542 10547 21c1214 10541->10547 10542->10323 10543 21c12dd 10543->10323 10546 21c3b07 6 API calls 10548 21c12b9 10546->10548 10547->10543 10547->10548 10550 21c3b35 10547->10550 10561 21c3adf 10547->10561 10566 21c3b07 10547->10566 10548->10543 10548->10546 10551 21c3b53 InterlockedIncrement 10550->10551 10554 21c3b40 10550->10554 10552 21c3b6f InterlockedDecrement 10551->10552 10557 21c3b79 10551->10557 10555 21c556e 29 API calls 10552->10555 10554->10547 10555->10557 10571 21c3ba4 10557->10571 10558 21c3b8f 10577 21c55cf LeaveCriticalSection 10558->10577 10559 21c3b99 InterlockedDecrement 10559->10554 10562 21c3ae8 10561->10562 10563 21c3af6 10561->10563 10564 21c5464 6 API calls 10562->10564 10563->10547 10565 21c3af3 10564->10565 10565->10547 10567 21c3b10 10566->10567 10568 21c3b21 10566->10568 10569 21c5464 6 API calls 10567->10569 10568->10547 10570 21c3b1e 10569->10570 10570->10547 10572 21c3b86 10571->10572 10574 21c3bd1 10571->10574 10572->10558 10572->10559 10573 21c3bef 10573->10572 10582 21c55e4 10573->10582 10574->10573 10578 21c5464 10574->10578 10577->10554 10579 21c5482 10578->10579 10581 21c5476 10578->10581 10600 21c8b9e 10579->10600 10581->10573 10583 21c5630 10582->10583 10584 21c5614 LCMapStringW 10582->10584 10586 21c5679 LCMapStringA 10583->10586 10587 21c5696 10583->10587 10584->10583 10585 21c5638 LCMapStringA 10584->10585 10585->10583 10588 21c5772 10585->10588 10586->10588 10587->10588 10589 21c56ac MultiByteToWideChar 10587->10589 10588->10572 10589->10588 10590 21c56d6 10589->10590 10590->10588 10591 21c570c MultiByteToWideChar 10590->10591 10591->10588 10592 21c5725 LCMapStringW 10591->10592 10592->10588 10593 21c5740 10592->10593 10594 21c5746 10593->10594 10596 21c5786 10593->10596 10594->10588 10595 21c5754 LCMapStringW 10594->10595 10595->10588 10596->10588 10597 21c57be LCMapStringW 10596->10597 10597->10588 10598 21c57d6 WideCharToMultiByte 10597->10598 10598->10588 10601 21c8be7 10600->10601 10602 21c8bcf GetStringTypeW 10600->10602 10603 21c8c36 10601->10603 10604 21c8c12 GetStringTypeA 10601->10604 10602->10601 10605 21c8beb GetStringTypeA 10602->10605 10606 21c8cd3 10603->10606 10608 21c8c4c MultiByteToWideChar 10603->10608 10604->10606 10605->10601 10605->10606 10606->10581 10608->10606 10609 21c8c70 10608->10609 10609->10606 10610 21c8caa MultiByteToWideChar 10609->10610 10610->10606 10611 21c8cc3 GetStringTypeW 10610->10611 10611->10606 10613 21c2100 48 API calls 10612->10613 10614 21c2824 CreateFileA 10613->10614 10615 21c284a 10614->10615 10616 21c2855 DeviceIoControl 10614->10616 10615->10352 10617 21c2888 10616->10617 10618 21c28f0 CloseHandle 10616->10618 10617->10618 10619 21c2100 48 API calls 10617->10619 10618->10352 10620 21c28e8 10619->10620 10620->10618 10622 21c41f2 InterlockedIncrement 10621->10622 10634 21c41c8 10621->10634 10623 21c4214 10622->10623 10624 21c4206 InterlockedDecrement 10622->10624 10626 21c422a 10623->10626 10627 21c4267 10623->10627 10625 21c556e 29 API calls 10624->10625 10625->10623 10629 21c422f 10626->10629 10630 21c4239 InterlockedDecrement 10626->10630 10628 21c55e4 9 API calls 10627->10628 10631 21c427e 10628->10631 10643 21c55cf LeaveCriticalSection 10629->10643 10630->10634 10633 21c42ac 10631->10633 10637 21c3ea7 29 API calls 10631->10637 10635 21c42c7 10633->10635 10636 21c42d1 InterlockedDecrement 10633->10636 10634->10367 10644 21c55cf LeaveCriticalSection 10635->10644 10639 21c42ce 10636->10639 10640 21c428d 10637->10640 10641 21c3dbe 29 API calls 10639->10641 10640->10633 10642 21c55e4 9 API calls 10640->10642 10641->10634 10642->10633 10643->10634 10644->10639 10873 4015b3 10874 4029e8 18 API calls 10873->10874 10875 4015ba 10874->10875 10876 4055ca 4 API calls 10875->10876 10883 4015c2 10876->10883 10877 40160a 10878 40160f 10877->10878 10881 40162d 10877->10881 10880 401423 25 API calls 10878->10880 10879 405561 CharNextA 10882 4015d0 CreateDirectoryA 10879->10882 10886 401616 10880->10886 10885 401423 25 API calls 10881->10885 10882->10883 10884 4015e5 GetLastError 10882->10884 10883->10877 10883->10879 10884->10883 10887 4015f2 GetFileAttributesA 10884->10887 10890 40215b 10885->10890 10891 405a43 lstrcpynA 10886->10891 10887->10883 10889 401621 SetCurrentDirectoryA 10889->10890 10891->10889

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 00403225 Relevance: 73.8, APIs: 24, Strings: 18, Instructions: 270filestringcomCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 0 403225-4032ba #17 SetErrorMode OleInitialize call 405d61 SHGetFileInfoA call 405a43 GetCommandLineA call 405a43 GetModuleHandleA 7 4032c6-4032db call 405561 CharNextA 0->7 8 4032bc-4032c1 0->8 11 403340-403344 7->11 8->7 12 403346 11->12 13 4032dd-4032e0 11->13 16 403359-403371 GetTempPathA call 4031f1 12->16 14 4032e2-4032e6 13->14 15 4032e8-4032f0 13->15 14->14 14->15 17 4032f2-4032f3 15->17 18 4032f8-4032fb 15->18 25 403393-4033aa DeleteFileA call 402c5b 16->25 26 403373-403391 GetWindowsDirectoryA lstrcatA call 4031f1 16->26 17->18 20 403330-40333d call 405561 18->20 21 4032fd-403301 18->21 20->11 38 40333f 20->38 23 403311-403317 21->23 24 403303-40330c 21->24 30 403327-40332e 23->30 31 403319-403322 23->31 24->23 28 40330e 24->28 40 403411-403420 ExitProcess OleUninitialize 25->40 41 4033ac-4033b2 25->41 26->25 26->40 28->23 30->20 36 403348-403354 call 405a43 30->36 31->30 35 403324 31->35 35->30 36->16 38->11 44 403426-403436 call 405304 ExitProcess 40->44 45 40350b-403511 40->45 42 403401-403408 call 4035e3 41->42 43 4033b4-4033bd call 405561 41->43 53 40340d 42->53 58 4033c8-4033ca 43->58 46 403513-403530 call 405d61 * 3 45->46 47 40358e-403596 45->47 73 403532-403534 46->73 74 40357a-403585 ExitWindowsEx 46->74 54 403598 47->54 55 40359c-4035a0 ExitProcess 47->55 53->40 54->55 59 4033cc-4033d6 58->59 60 4033bf-4033c5 58->60 62 4033d8-4033e5 call 405617 59->62 63 40343c-403456 lstrcatA lstrcmpiA 59->63 60->59 65 4033c7 60->65 62->40 76 4033e7-4033fd call 405a43 * 2 62->76 63->40 66 403458-40346d CreateDirectoryA SetCurrentDirectoryA 63->66 65->58 69 40347a-403494 call 405a43 66->69 70 40346f-403475 call 405a43 66->70 84 403499-4034b5 call 405a65 DeleteFileA 69->84 70->69 73->74 78 403536-403538 73->78 74->47 81 403587-403589 call 40140b 74->81 76->42 78->74 82 40353a-40354c GetCurrentProcess 78->82 81->47 82->74 91 40354e-403570 82->91 92 4034f6-4034fd 84->92 93 4034b7-4034c7 CopyFileA 84->93 91->74 92->84 94 4034ff-403506 call 405791 92->94 93->92 95 4034c9-4034e9 call 405791 call 405a65 call 4052a3 93->95 94->40 95->92 105 4034eb-4034f2 CloseHandle 95->105 105->92
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • #17.COMCTL32 ref: 00403244
                                                                                                                                                                                        • SetErrorMode.KERNEL32(00008001), ref: 0040324F
                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403256
                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        • SHGetFileInfoA.SHELL32(0041F4B8,00000000,?,00000160,00000000,00000008), ref: 0040327E
                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                        • GetCommandLineA.KERNEL32(00423700,NSIS Error), ref: 00403293
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000000), ref: 004032A6
                                                                                                                                                                                        • CharNextA.USER32(00000000,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000020), ref: 004032D1
                                                                                                                                                                                        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403364
                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403379
                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403385
                                                                                                                                                                                        • DeleteFileA.KERNEL32(2052), ref: 00403398
                                                                                                                                                                                        • ExitProcess.KERNEL32(00000000), ref: 00403411
                                                                                                                                                                                        • OleUninitialize.OLE32(00000000), ref: 00403416
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403436
                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000000,00000000), ref: 00403442
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Program Files (x86)\360\360Desktop\modules), ref: 0040344E
                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040345A
                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403461
                                                                                                                                                                                        • DeleteFileA.KERNEL32(0041F0B8,0041F0B8,?,59cd53708ed730f0ef42bb01f668d936,?), ref: 004034AB
                                                                                                                                                                                        • CopyFileA.KERNEL32(C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,0041F0B8,00000001), ref: 004034BF
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,0041F0B8,0041F0B8,?,0041F0B8,00000000), ref: 004034EC
                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403541
                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,00000000), ref: 0040357D
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004035A0
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExitFileProcess$DirectoryHandle$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                                                                                                                                        • String ID: /D=$ _?=$"$"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$2052$59cd53708ed730f0ef42bb01f668d936$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\360bizhi$C:\Users\user\AppData\Roaming\360wp\User Data$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
                                                                                                                                                                                        • API String ID: 553446912-2443468689
                                                                                                                                                                                        • Opcode ID: f1dc0173ad89198c85e38e49cb9c8fc9ce30ec73a9de808b9ea016f6acfa90af
                                                                                                                                                                                        • Instruction ID: 12b4adbb734880863a6c7b42456f84a79c3c9dcdf907d3cda67c8baecb7e3ac4
                                                                                                                                                                                        • Opcode Fuzzy Hash: f1dc0173ad89198c85e38e49cb9c8fc9ce30ec73a9de808b9ea016f6acfa90af
                                                                                                                                                                                        • Instruction Fuzzy Hash: DD91C370A08351BFD721AFA1AD89B1B7EACAB40306F44453BF541B61D2C77C9E418B6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405368 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156filestringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 284 405368-405383 call 405617 287 405385-405397 DeleteFileA 284->287 288 40539c-4053a6 284->288 289 405530-405533 287->289 290 4053a8-4053aa 288->290 291 4053ba-4053c8 call 405a43 288->291 292 4053b0-4053b4 290->292 293 4054db-4054e1 290->293 299 4053d7-4053d8 call 40557d 291->299 300 4053ca-4053d5 lstrcatA 291->300 292->291 292->293 293->289 295 4054e3-4054e6 293->295 297 4054f0-4054f8 call 405d3a 295->297 298 4054e8-4054ee 295->298 297->289 307 4054fa-40550f call 405536 call 4056fb RemoveDirectoryA 297->307 298->289 302 4053dd-4053e0 299->302 300->302 305 4053e2-4053e9 302->305 306 4053eb-4053f1 lstrcatA 302->306 305->306 308 4053f6-405414 lstrlenA FindFirstFileA 305->308 306->308 323 405511-405515 307->323 324 405528-40552b call 404de1 307->324 310 4054d1-4054d5 308->310 311 40541a-405431 call 405561 308->311 310->293 314 4054d7 310->314 317 405433-405437 311->317 318 40543c-40543f 311->318 314->293 317->318 320 405439 317->320 321 405441-405446 318->321 322 405452-405460 call 405a43 318->322 320->318 326 4054b0-4054c2 FindNextFileA 321->326 327 405448-40544a 321->327 334 405462-40546a 322->334 335 405477-405486 call 4056fb DeleteFileA 322->335 323->298 329 405517-405526 call 404de1 call 405791 323->329 324->289 326->311 332 4054c8-4054cb FindClose 326->332 327->322 330 40544c-405450 327->330 329->289 330->322 330->326 332->310 334->326 338 40546c-405475 call 405368 334->338 343 4054a8-4054ab call 404de1 335->343 344 405488-40548c 335->344 338->326 343->326 346 4054a0-4054a6 344->346 347 40548e-40549e call 404de1 call 405791 344->347 346->326 347->326
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 00405386
                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 004053D0
                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 004053F1
                                                                                                                                                                                        • lstrlenA.KERNEL32(?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 004053F7
                                                                                                                                                                                        • FindFirstFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*,?,?,?,0040900C,?,C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*,?,00000000,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 00405408
                                                                                                                                                                                        • FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 004054BA
                                                                                                                                                                                        • FindClose.KERNEL32(?), ref: 004054CB
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\*.*$\*.*
                                                                                                                                                                                        • API String ID: 2035342205-1245606505
                                                                                                                                                                                        • Opcode ID: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                        • Instruction ID: 005fd70f037958758636dfc326b5af0e8b30b209f19d8c1cd7988b565b373fb6
                                                                                                                                                                                        • Opcode Fuzzy Hash: d79991f4805db549c34630898c0636815ff593e5008f03f6b67846bfa4c813be
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B51E030904A447ADB216B618C89BFF3A68DF4271AF54807BF945711D2C77C4982DE6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405D3A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileA.KERNEL32(?,00422550,C:\,0040565A,C:\,C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 00405D45
                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405D51
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                        • String ID: C:\$P%B
                                                                                                                                                                                        • API String ID: 2295610775-2202030105
                                                                                                                                                                                        • Opcode ID: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                        • Instruction ID: fa9aa61da9af08e62d153dff6cda9e4686c5a383a1128ef99b384ed87a871bf9
                                                                                                                                                                                        • Opcode Fuzzy Hash: be2546b6ba86d447be3416eb2cce205da5c5492487841b48ac91d8ee35da52c0
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6DD0C9319095206BC20027286D0C84B6A59DF09330710CA73B12AF22F0D27499628AA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040600A Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                        • Instruction ID: 4dd2872783d64c99001b1edb157d711bf7c17726e9b979133eda9d6147b50661
                                                                                                                                                                                        • Opcode Fuzzy Hash: ca48c4465a76fd19d6f3463da993c6ca3d09651b6bc0314a9d0f7ba33f731e04
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8DF15671D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004035E3 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 213stringregistrylibraryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 106 4035e3-4035fb call 405d61 109 4035fd-40360d call 4059a1 106->109 110 40360f-403636 call 40592a 106->110 119 403659-403678 call 403897 call 405617 109->119 115 403638-403649 call 40592a 110->115 116 40364e-403654 lstrcatA 110->116 115->116 116->119 124 40367e-403683 119->124 125 4036ff-403707 call 405617 119->125 124->125 126 403685-40369d call 40592a 124->126 131 403715-40373a LoadImageA 125->131 132 403709-403710 call 405a65 125->132 130 4036a2-4036a9 126->130 130->125 133 4036ab-4036ad 130->133 135 403740-403776 RegisterClassA 131->135 136 4037c9-4037d1 call 40140b 131->136 132->131 137 4036be-4036ca lstrlenA 133->137 138 4036af-4036bc call 405561 133->138 139 40377c-4037c4 SystemParametersInfoA CreateWindowExA 135->139 140 40388d 135->140 147 4037d3-4037d6 136->147 148 4037db-4037e6 call 403897 136->148 145 4036f2-4036fa call 405536 call 405a43 137->145 146 4036cc-4036da lstrcmpiA 137->146 138->137 139->136 143 40388f-403896 140->143 145->125 146->145 151 4036dc-4036e6 GetFileAttributesA 146->151 147->143 159 403864-40386c call 404eb3 148->159 160 4037e8-403805 ShowWindow LoadLibraryA 148->160 154 4036e8-4036ea 151->154 155 4036ec-4036ed call 40557d 151->155 154->145 154->155 155->145 168 403886-403888 call 40140b 159->168 169 40386e-403874 159->169 161 403807-40380c LoadLibraryA 160->161 162 40380e-403820 GetClassInfoA 160->162 161->162 164 403822-403832 GetClassInfoA RegisterClassA 162->164 165 403838-403862 DialogBoxParamA call 40140b 162->165 164->165 165->143 168->140 169->147 170 40387a-403881 call 40140b 169->170 170->147
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        • lstrcatA.KERNEL32(2052,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403654
                                                                                                                                                                                        • lstrlenA.KERNEL32(zhuomian,?,?,?,zhuomian,00000000,C:\Users\user\AppData\Roaming\360bizhi,2052,00420500,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420500,00000000,00000006,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian), ref: 004036BF
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 004036D2
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(zhuomian), ref: 004036DD
                                                                                                                                                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\360bizhi), ref: 00403726
                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                        • RegisterClassA.USER32 ref: 0040376D
                                                                                                                                                                                        • SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403785
                                                                                                                                                                                        • CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037BE
                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 004037F0
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd20), ref: 00403801
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(RichEd32), ref: 0040380C
                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,004236A0), ref: 0040381C
                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit,004236A0), ref: 00403829
                                                                                                                                                                                        • RegisterClassA.USER32(004236A0), ref: 00403832
                                                                                                                                                                                        • DialogBoxParamA.USER32(?,00000000,00403964,00000000), ref: 00403851
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$.DEFAULT\Control Panel\International$.exe$2052$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\360bizhi$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$zhuomian
                                                                                                                                                                                        • API String ID: 914957316-1385584051
                                                                                                                                                                                        • Opcode ID: 97f1c0a895908061ccf181a955fc906cb901a1c76f7d9b3106eede6371099e0d
                                                                                                                                                                                        • Instruction ID: 94625ed8aaa298a99e1261382a478c85dd538f94d9e759fa5c435ea2279a3c1b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 97f1c0a895908061ccf181a955fc906cb901a1c76f7d9b3106eede6371099e0d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D61B3B1604200BED620AF65AD45E2B3AADEB4474AF44447FF940B22E1D77D9E018A2E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402C5B Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203memoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 175 402c5b-402ca9 GetTickCount GetModuleFileNameA call 40571a 178 402cb5-402ce3 call 405a43 call 40557d call 405a43 GetFileSize 175->178 179 402cab-402cb0 175->179 187 402dd3-402de1 call 402bc5 178->187 188 402ce9-402d00 178->188 180 402efa-402efe 179->180 194 402eb2-402eb7 187->194 195 402de7-402dea 187->195 190 402d02 188->190 191 402d04-402d0a call 4031a8 188->191 190->191 196 402d0f-402d11 191->196 194->180 197 402e16-402e62 GlobalAlloc call 405e3b call 405749 CreateFileA 195->197 198 402dec-402e04 call 4031da call 4031a8 195->198 199 402d17-402d1d 196->199 200 402e6e-402e76 call 402bc5 196->200 225 402e64-402e69 197->225 226 402e78-402ea8 call 4031da call 402f01 197->226 198->194 223 402e0a-402e10 198->223 204 402d9d-402da1 199->204 205 402d1f-402d37 call 4056db 199->205 200->194 208 402da3-402da9 call 402bc5 204->208 209 402daa-402db0 204->209 205->209 222 402d39-402d40 205->222 208->209 214 402db2-402dc0 call 405dcd 209->214 215 402dc3-402dcd 209->215 214->215 215->187 215->188 222->209 227 402d42-402d49 222->227 223->194 223->197 225->180 235 402ead-402eb0 226->235 227->209 229 402d4b-402d52 227->229 229->209 230 402d54-402d5b 229->230 230->209 232 402d5d-402d7d 230->232 232->194 234 402d83-402d87 232->234 236 402d89-402d8d 234->236 237 402d8f-402d97 234->237 235->194 238 402eb9-402eca 235->238 236->187 236->237 237->209 239 402d99-402d9b 237->239 240 402ed2-402ed7 238->240 241 402ecc 238->241 239->209 242 402ed8-402ede 240->242 241->240 242->242 243 402ee0-402ef8 call 4056db 242->243 243->180
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402C6F
                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,00000400), ref: 00402C8B
                                                                                                                                                                                          • Part of subcall function 0040571A: GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                          • Part of subcall function 0040571A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 00402CD4
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00409190), ref: 00402E1B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C5B, 00402E33
                                                                                                                                                                                        • Inst, xrefs: 00402D42
                                                                                                                                                                                        • The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t, xrefs: 00402EB2
                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian, xrefs: 00402C68
                                                                                                                                                                                        • !9, xrefs: 00402EE0
                                                                                                                                                                                        • soft, xrefs: 00402D4B
                                                                                                                                                                                        • Null, xrefs: 00402D54
                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 00402CB6, 00402CBB, 00402CC1
                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe, xrefs: 00402C75, 00402C84, 00402C98, 00402CB5
                                                                                                                                                                                        • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E64
                                                                                                                                                                                        • Error launching installer, xrefs: 00402CAB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$C:\Program Files (x86)\360\360Desktop\modules$C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe$C:\Users\user\AppData\Local\Temp\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Null$The installer you are trying to use is corrupted or incomplete.This could be the result of a damaged disk, a failed download or a virus.You may want to contact the author of this installer to obtain a new copy.It may be possible to skip this check using t$soft$!9
                                                                                                                                                                                        • API String ID: 2803837635-3244124285
                                                                                                                                                                                        • Opcode ID: 5fb05577fb859e6eb9f36d83186ada6f4c098edcd536b112a9abc2a7ce8c9c66
                                                                                                                                                                                        • Instruction ID: 98420d4c95cb0715ed39ffe41bcd432428fd7d62b31351ae7306db0730cac7b6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5fb05577fb859e6eb9f36d83186ada6f4c098edcd536b112a9abc2a7ce8c9c66
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C61C231E40214ABDB20DF64EE49B9A7BB4AB48315F50413BF904B72D1D7BC9E418BAD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405791 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 144filememoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 246 405791-4057a2 call 405d61 249 4057a4-4057af MoveFileExA 246->249 250 4057b5-4057d1 246->250 249->250 251 4058ee 249->251 252 4057d3-4057eb call 40571a CloseHandle GetShortPathNameA 250->252 253 4057f9-405808 GetShortPathNameA 250->253 254 4058f4-4058f8 251->254 252->254 260 4057f1-4057f3 252->260 253->254 256 40580e-405810 253->256 256->254 257 405816-405854 wsprintfA call 405a65 call 40571a 256->257 257->251 264 40585a-405876 GetFileSize GlobalAlloc 257->264 260->253 260->254 265 4058e7-4058e8 CloseHandle 264->265 266 405878-40588a ReadFile 264->266 265->251 266->265 267 40588c-405890 266->267 267->265 268 405892-40589f call 40568f 267->268 271 4058a1-4058af call 405a43 268->271 272 4058fb-40590b call 40568f 268->272 277 4058b2 271->277 272->277 278 40590d-405915 272->278 281 4058b4-4058e1 call 4056db SetFilePointer WriteFile GlobalFree 277->281 279 405922-405928 278->279 280 405917-405920 278->280 279->281 280->279 280->280 281->265
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405D61: GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                          • Part of subcall function 00405D61: LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                          • Part of subcall function 00405D61: GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        • MoveFileExA.KERNEL32(00000000,?,00000005,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057AB
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405526,?,00000000,000000F1,?), ref: 004057DE
                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(?,00422690,00000400), ref: 004057E7
                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(00000000,00422108,00000400), ref: 00405804
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405822
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00422108,C0000000,00000004,00422108,?,?,?,00000000,000000F1,?), ref: 0040585D
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040586C
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 00405882
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421D08,00000000,-0000000A,004093B0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004058C8
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004058DA
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004058E1
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 004058E8
                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                          • Part of subcall function 0040568F: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModuleMovePointerProcReadSizeWritewsprintf
                                                                                                                                                                                        • String ID: %s=%s$[Rename]
                                                                                                                                                                                        • API String ID: 3178728463-1727408572
                                                                                                                                                                                        • Opcode ID: e9ce49729cb88f09fd70508b5b6f2b3f2c96f64563c3098240f57232e89c8bcc
                                                                                                                                                                                        • Instruction ID: b4a0761097f53e27704103e00ee6cd595734002638f7a2c326e30edaa923f398
                                                                                                                                                                                        • Opcode Fuzzy Hash: e9ce49729cb88f09fd70508b5b6f2b3f2c96f64563c3098240f57232e89c8bcc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 54410432A05B11BBE7206B619D49F6B3A6CEF44715F044436FD05F62D2E678A8018EBD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405A65 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 195stringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 353 405a65-405a70 354 405a72-405a81 353->354 355 405a83-405aa0 353->355 354->355 356 405aa6-405aad 355->356 357 405c7e-405c82 355->357 356->357 358 405ab2-405abc 357->358 359 405c88-405c92 357->359 358->359 362 405ac2-405ac9 358->362 360 405c94-405c98 call 405a43 359->360 361 405c9d-405c9e 359->361 360->361 364 405c71 362->364 365 405acf-405b00 362->365 366 405c73-405c79 364->366 367 405c7b-405c7d 364->367 368 405b06-405b11 GetVersion 365->368 369 405c1b-405c1e 365->369 366->357 367->357 372 405b13-405b17 368->372 373 405b2b 368->373 370 405c20-405c23 369->370 371 405c4e-405c51 369->371 374 405c33-405c3f call 405a43 370->374 375 405c25-405c31 call 4059a1 370->375 377 405c53-405c5a call 405a65 371->377 378 405c5f-405c6f lstrlenA 371->378 372->373 379 405b19-405b1d 372->379 376 405b32-405b39 373->376 390 405c44-405c4a 374->390 375->390 382 405b3b-405b3d 376->382 383 405b3e-405b40 376->383 377->378 378->357 379->373 380 405b1f-405b23 379->380 380->373 386 405b25-405b29 380->386 382->383 388 405b42-405b65 call 40592a 383->388 389 405b79-405b7c 383->389 386->376 400 405c02-405c06 388->400 401 405b6b-405b74 call 405a65 388->401 393 405b8c-405b8f 389->393 394 405b7e-405b8a GetSystemDirectoryA 389->394 390->378 392 405c4c 390->392 396 405c13-405c19 call 405ca1 392->396 398 405b91-405b9f GetWindowsDirectoryA 393->398 399 405bf9-405bfb 393->399 397 405bfd-405c00 394->397 396->378 397->396 397->400 398->399 399->397 402 405ba1-405bab 399->402 400->396 407 405c08-405c0e lstrcatA 400->407 401->397 404 405bc5-405bdb SHGetSpecialFolderLocation 402->404 405 405bad-405bb0 402->405 410 405bf6 404->410 411 405bdd-405bf4 SHGetPathFromIDListA CoTaskMemFree 404->411 405->404 409 405bb2-405bb9 405->409 407->396 413 405bc1-405bc3 409->413 410->399 411->397 411->410 413->397 413->404
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetVersion.KERNEL32(?,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405B09
                                                                                                                                                                                        • GetSystemDirectoryA.KERNEL32(zhuomian,00000400), ref: 00405B84
                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(zhuomian,00000400), ref: 00405B97
                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405BD3
                                                                                                                                                                                        • SHGetPathFromIDListA.SHELL32(00000000,zhuomian), ref: 00405BE1
                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00405BEC
                                                                                                                                                                                        • lstrcatA.KERNEL32(zhuomian,\Microsoft\Internet Explorer\Quick Launch), ref: 00405C0E
                                                                                                                                                                                        • lstrlenA.KERNEL32(zhuomian,?,0041FCD8,00000000,00404E19,0041FCD8,00000000), ref: 00405C60
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$zhuomian
                                                                                                                                                                                        • API String ID: 900638850-213336807
                                                                                                                                                                                        • Opcode ID: deb8cadcda4d035cdc64311d821c0dcc34042e8c40dbf8a3a3430eba01356339
                                                                                                                                                                                        • Instruction ID: 9b1bf7279014b7c8101eb7e454522d29597b913ca5fabe9a72ab98517bc843d5
                                                                                                                                                                                        • Opcode Fuzzy Hash: deb8cadcda4d035cdc64311d821c0dcc34042e8c40dbf8a3a3430eba01356339
                                                                                                                                                                                        • Instruction Fuzzy Hash: 50512671A04A05AAEB205F68DC84B7F3B74EB11714F14023BE911B62E1D33C6982DF5E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401734 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 414 401734-401757 call 4029e8 call 4055a3 419 401761-401773 call 405a43 call 405536 lstrcatA 414->419 420 401759-40175f call 405a43 414->420 425 401778-40177e call 405ca1 419->425 420->425 430 401783-401787 425->430 431 401789-401793 call 405d3a 430->431 432 4017ba-4017bd 430->432 439 4017a5-4017b7 431->439 440 401795-4017a3 CompareFileTime 431->440 433 4017c5-4017e1 call 40571a 432->433 434 4017bf-4017c0 call 4056fb 432->434 442 4017e3-4017e6 433->442 443 401859-401882 call 404de1 call 402f01 433->443 434->433 439->432 440->439 444 4017e8-40182a call 405a43 * 2 call 405a65 call 405a43 call 405304 442->444 445 40183b-401845 call 404de1 442->445 455 401884-401888 443->455 456 40188a-401896 SetFileTime 443->456 444->430 477 401830-401831 444->477 457 40184e-401854 445->457 455->456 459 40189c-4018a7 FindCloseChangeNotification 455->459 456->459 460 402886 457->460 463 40287d-402880 459->463 464 4018ad-4018b0 459->464 462 402888-40288c 460->462 463->460 467 4018b2-4018c3 call 405a65 lstrcatA 464->467 468 4018c5-4018c8 call 405a65 464->468 474 4018cd-4021fb 467->474 468->474 478 402200-402205 474->478 479 4021fb call 405304 474->479 477->457 480 401833-401834 477->480 478->462 479->478 480->445
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrcatA.KERNEL32(00000000,00000000,00409408,C:\Users\user\AppData\Roaming\360wp\User Data,00000000,00000000,00000031), ref: 00401773
                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,00409408,00409408,00000000,00000000,00409408,C:\Users\user\AppData\Roaming\360wp\User Data,00000000,00000000,00000031), ref: 0040179D
                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\System.dll$C:\Users\user\AppData\Roaming\360wp\User Data$zhuomian
                                                                                                                                                                                        • API String ID: 1941528284-1584438867
                                                                                                                                                                                        • Opcode ID: 162a66a5d63f4167212c2692ab83d910656b2982ca0eaaed571ca35e1fd446d6
                                                                                                                                                                                        • Instruction ID: 502ebc8251cf4d34670626f1a6973296816b4538e99af67961374f69fd5ad3b4
                                                                                                                                                                                        • Opcode Fuzzy Hash: 162a66a5d63f4167212c2692ab83d910656b2982ca0eaaed571ca35e1fd446d6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B41E371A00514BACF10BBB9DD86DAF3A69EF45368B20433BF111B11E1D67C8B418E6D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 1000347F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105registrymemoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 481 1000347f-1000348d 482 10003493-100034be call 10002f8e RegQueryValueExA 481->482 483 10003567-10003569 481->483 489 100034c4-100034c8 482->489 490 10003558-10003566 call 10002335 482->490 485 10003585-1000358e call 100022b7 483->485 486 1000356b-10003584 RegQueryValueExW 483->486 493 100034ca-100034ce 489->493 494 100034ef-100034f7 489->494 493->494 496 100034d0-100034d4 493->496 497 10003540-10003545 494->497 498 100034f9-10003509 GlobalAlloc 494->498 496->494 499 100034d6-100034ed RegQueryValueExA 496->499 502 10003547-1000354a 497->502 503 1000354c-1000354e 497->503 500 1000350b-1000352d RegQueryValueExA call 1000237c 498->500 501 1000353f 498->501 499->490 507 10003532-10003539 GlobalFree 500->507 501->497 502->503 505 10003550-10003555 503->505 506 10003557 503->506 505->506 506->490 507->501
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,IsUserActive,00000000), ref: 100034FF
                                                                                                                                                                                        • RegQueryValueExA.KERNELBASE(00000001,?,?,?,00000000,?), ref: 1000351C
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10003539
                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 1000357D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • \??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp, xrefs: 10003493
                                                                                                                                                                                        • IsUserActive, xrefs: 100034F9
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: QueryValue$Global$AllocFree
                                                                                                                                                                                        • String ID: IsUserActive$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 1034700490-3999321949
                                                                                                                                                                                        • Opcode ID: 667577040a506b28336520f71bc1f51e19cf36d0fad04b464ea628e513f7ecfe
                                                                                                                                                                                        • Instruction ID: 81d722525f6eb703a7675ca5f3ce6bcf65688ca7e786388ace9c35b78997f692
                                                                                                                                                                                        • Opcode Fuzzy Hash: 667577040a506b28336520f71bc1f51e19cf36d0fad04b464ea628e513f7ecfe
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D31187290014AFFEF02CF94CC41AEF7BBAFF08284F108059FA15A6124D732AA60DB50
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402F01 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 508 402f01-402f10 509 402f12-402f28 SetFilePointer 508->509 510 402f2e-402f39 call 40302c 508->510 509->510 513 403025-403029 510->513 514 402f3f-402f59 ReadFile 510->514 515 403022 514->515 516 402f5f-402f62 514->516 518 403024 515->518 516->515 517 402f68-402f7b call 40302c 516->517 517->513 521 402f81-402f84 517->521 518->513 522 402ff1-402ff7 521->522 523 402f86-402f89 521->523 524 402ff9 522->524 525 402ffc-40300f ReadFile 522->525 526 40301d-403020 523->526 527 402f8f 523->527 524->525 525->515 528 403011-40301a 525->528 526->513 529 402f94-402f9c 527->529 528->526 530 402fa1-402fb3 ReadFile 529->530 531 402f9e 529->531 530->515 532 402fb5-402fb8 530->532 531->530 532->515 533 402fba-402fcf WriteFile 532->533 534 402fd1-402fd4 533->534 535 402fed-402fef 533->535 534->535 536 402fd6-402fe9 534->536 535->518 536->529 537 402feb 536->537 537->526
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00409190,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190,?), ref: 00402F28
                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000004,?,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000,00000000,00409190), ref: 00402F55
                                                                                                                                                                                        • ReadFile.KERNEL32(004130A0,00004000,?,00000000,00409190,?,00402EAD,000000FF,00000000,00000000,00409190,?), ref: 00402FAF
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,004130A0,?,000000FF,00000000,?,00402EAD,000000FF,00000000,00000000,00409190,?), ref: 00402FC7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Read$PointerWrite
                                                                                                                                                                                        • String ID: !9
                                                                                                                                                                                        • API String ID: 2113905535-933955959
                                                                                                                                                                                        • Opcode ID: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                        • Instruction ID: f57f03ec19a78774be9adcd31849d1562aa90d9077fbbcd5e62cb2d9af4c63a1
                                                                                                                                                                                        • Opcode Fuzzy Hash: e7aa4ed127fe1e46993ca192cdfef24e141fd06e931b79e132da23cb1131dd4c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D311A31901209EFDF21CF95DE44EAE7BBCEB44365F24403AF904A61E0D2749E40EB69
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040266E Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026C2
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026DE
                                                                                                                                                                                        • GlobalFree.KERNELBASE(?), ref: 00402717
                                                                                                                                                                                        • WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402729
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402730
                                                                                                                                                                                        • FindCloseChangeNotification.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402748
                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040275C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFileFree$ChangeCloseDeleteFindNotificationWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2326852265-0
                                                                                                                                                                                        • Opcode ID: 32859fda9f92782a5a51194cda546ed71ef65f75f384b436084f0cd6aa7a6abf
                                                                                                                                                                                        • Instruction ID: c44f166cf789c73980343851032ece5a06a24c9bd4eff2e899fc72ce2868172c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 32859fda9f92782a5a51194cda546ed71ef65f75f384b436084f0cd6aa7a6abf
                                                                                                                                                                                        • Instruction Fuzzy Hash: 79318D71C00128BBDF116FA5CE89D9E7E79EF09324F10422AF914762E0C7795D419BA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 1000358F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79registrymemoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegSetValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000), ref: 100035D4
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00000000,10027780), ref: 100035E6
                                                                                                                                                                                        • RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000000,00000000,10027780,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 1000360E
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10003618
                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(?,10027780,00000000,?,00000000,00000000,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp), ref: 10003644
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • \??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp, xrefs: 100035A5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Value$Global$AllocFree
                                                                                                                                                                                        • String ID: \??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 2273869824-1302025716
                                                                                                                                                                                        • Opcode ID: a445b501be8d8de309ca3c80ba5540f8b3ad5a8f85e0d323dc708c464a9c4908
                                                                                                                                                                                        • Instruction ID: ae50ba5e7a2cc0507a585ab724dadc37df32a6046dc0e37f4cb27eab9507f8c4
                                                                                                                                                                                        • Opcode Fuzzy Hash: a445b501be8d8de309ca3c80ba5540f8b3ad5a8f85e0d323dc708c464a9c4908
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0921F87650011AFFEF129F94DC4599F7FBAEF486D0B208014FA0592228DB329D61EBA0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401F51 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 592 401f51-401f5d 593 401f63-401f79 call 4029e8 * 2 592->593 594 40200b-40200d 592->594 604 401f88-401f96 LoadLibraryExA 593->604 605 401f7b-401f86 GetModuleHandleA 593->605 596 402156-40215b call 401423 594->596 602 40287d-40288c 596->602 607 401f98-401fa6 GetProcAddress 604->607 608 402004-402006 604->608 605->604 605->607 609 401fe5-401fea call 404de1 607->609 610 401fa8-401fae 607->610 608->596 614 401fef-401ff2 609->614 612 401fb0-401fbc call 401423 610->612 613 401fc7-401fdb 610->613 612->614 620 401fbe-401fc5 612->620 621 401fde call 100042b0 613->621 622 401fde call 100048b1 613->622 623 401fde call 10004398 613->623 614->602 617 401ff8-401fff FreeLibrary 614->617 616 401fe0-401fe3 616->614 617->602 620->614 621->616 622->616 623->616
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00401FF9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$tY
                                                                                                                                                                                        • API String ID: 2987980305-588104494
                                                                                                                                                                                        • Opcode ID: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                        • Instruction ID: 0a17743dc10516c1e404603622caa6e4d13095454b29418bb929f5860ba01445
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ba81a86efe2a2d9b6cd3c65a8b682f798fdfffff416755953f0630403a9acca
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4611D872D04115A7CF107FA4DE85EAE75B0AB44359F204237F611B62E0C77C4941965E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C624F Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 624 21c624f-21c6259 625 21c625b-21c626b 624->625 626 21c62c1-21c62c4 624->626 627 21c62ad-21c62bf HeapFree 625->627 628 21c626d-21c6278 625->628 629 21c62e8-21c62f6 HeapDestroy 626->629 630 21c62c6-21c62cb 626->630 627->629 632 21c627b-21c62ab VirtualFree * 2 HeapFree 628->632 631 21c62cd-21c62d2 630->631 633 21c62d4-21c62dc VirtualFree 631->633 634 21c62e2-21c62e6 631->634 632->627 632->632 633->634 634->629 634->631
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C6287
                                                                                                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C6292
                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C629F
                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C62BB
                                                                                                                                                                                        • VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,021C44F1,021C4545,?,?,?), ref: 021C62DC
                                                                                                                                                                                        • HeapDestroy.KERNELBASE(?,?,021C44F1,021C4545,?,?,?), ref: 021C62EE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Free$HeapVirtual$Destroy
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 716807051-0
                                                                                                                                                                                        • Opcode ID: 1c9ffc6dcefae9bf2f329a06dcd5457be69220969de12ccae1a2559f2f0c669a
                                                                                                                                                                                        • Instruction ID: 68de22354d07f4922c3935d6f6ee8f305ff6481e15fef17586fb26d57e7dd443
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c9ffc6dcefae9bf2f329a06dcd5457be69220969de12ccae1a2559f2f0c669a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 97117339AC2200FBDA215E64FC85F0777E9F781721F314929E681B7054C7B6E8A1CB14
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10004398 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 184registryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 635 10004398-10004411 call 10002cf0 call 10002b98 * 4 call 100023b4 call 10002625 650 10004417-10004445 call 10003393 635->650 651 1000458f 635->651 650->651 656 1000444b-1000444e 650->656 652 10004594-1000459f call 10002c7b 651->652 658 10004551-10004577 call 10001e51 call 1000358f 656->658 659 10004454-10004458 656->659 668 10004579 658->668 659->658 661 1000445e-10004461 659->661 661->658 663 10004467-1000446a 661->663 663->658 665 10004470-10004473 663->665 665->658 667 10004479-1000447c 665->667 667->658 669 10004482-10004485 667->669 670 1000457c-1000458d RegCloseKey 668->670 669->658 671 1000448b-1000448e 669->671 670->651 670->652 672 10004490-10004493 671->672 673 100044ff-1000450e call 10001a83 671->673 672->673 674 10004495-10004498 672->674 683 10004510-10004534 673->683 684 10004537-1000453d 673->684 676 100044d1-100044d4 674->676 677 1000449a-100044a1 674->677 679 100044d6-100044d9 676->679 680 100044df-100044fd call 1000188c call 1000358f 676->680 681 100044a3-100044aa 677->681 682 100044bb 677->682 679->670 679->680 680->668 687 100044ac 681->687 688 100044af-100044b7 681->688 685 100044be-100044cf 682->685 683->684 689 1000453e-10004547 call 1000358f 684->689 685->689 687->688 688->681 691 100044b9 688->691 694 1000454c-1000454f 689->694 691->685 694->668
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                          • Part of subcall function 10003393: RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                        • RegCloseKey.KERNELBASE(00000000), ref: 1000457F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharCloseCreateFreeGlobalMultiWide
                                                                                                                                                                                        • String ID: IsUserActive$REG_DWORD$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 4251543773-2960318248
                                                                                                                                                                                        • Opcode ID: 160d70910c7556d6efce1072150f5861b7855c0f9ede8537b5eb1b8d8e125472
                                                                                                                                                                                        • Instruction ID: b4c99bf703c6d4f3faf4f10a0c974bb97cee2be09989649d504a6fe7688cbc7d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 160d70910c7556d6efce1072150f5861b7855c0f9ede8537b5eb1b8d8e125472
                                                                                                                                                                                        • Instruction Fuzzy Hash: A951E7F2E00504BBFB11DA64CC85EBF3AADEB853D1F124029F615A316ADF349E41C665
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040302C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 696 40302c-403055 GetTickCount 697 403196-40319e call 402bc5 696->697 698 40305b-403086 call 4031da SetFilePointer 696->698 703 4031a0-4031a5 697->703 704 40308b-40309d 698->704 705 4030a1-4030af call 4031a8 704->705 706 40309f 704->706 709 4030b5-4030c1 705->709 710 403188-40318b 705->710 706->705 711 4030c7-4030cd 709->711 710->703 712 4030f8-403114 call 405e5b 711->712 713 4030cf-4030d5 711->713 719 403191 712->719 720 403116-40311e 712->720 713->712 714 4030d7-4030f7 call 402bc5 713->714 714->712 721 403193-403194 719->721 722 403120-403136 WriteFile 720->722 723 403152-403158 720->723 721->703 725 403138-40313c 722->725 726 40318d-40318f 722->726 723->719 724 40315a-40315c 723->724 724->719 727 40315e-403171 724->727 725->726 728 40313e-40314a 725->728 726->721 727->704 730 403177-403186 SetFilePointer 727->730 728->711 729 403150 728->729 729->727 730->697
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00403041
                                                                                                                                                                                          • Part of subcall function 004031DA: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,?), ref: 004031E8
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?,?,00402EAD,000000FF,00000000), ref: 00403074
                                                                                                                                                                                        • WriteFile.KERNEL32(0040B0A0,0040C085,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 0040312E
                                                                                                                                                                                        • SetFilePointer.KERNEL32(003921ED,00000000,00000000,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000,00000000,?,?), ref: 00403180
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Pointer$CountTickWrite
                                                                                                                                                                                        • String ID: !9
                                                                                                                                                                                        • API String ID: 2146148272-933955959
                                                                                                                                                                                        • Opcode ID: 32b7c15da88a2ccc78eb3c9a966b00937d482487994a3c8693a9c70e9024f3ed
                                                                                                                                                                                        • Instruction ID: b900033f33315bf13e96bf0933fc3f5ca139b675e2fdc73b2e3f7a71e75fad19
                                                                                                                                                                                        • Opcode Fuzzy Hash: 32b7c15da88a2ccc78eb3c9a966b00937d482487994a3c8693a9c70e9024f3ed
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1641AE72505205AFC720DF18EE8496B3FBCF748356B01463FE520BA2E0D7386A459BAD
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004022F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402333
                                                                                                                                                                                        • lstrlenA.KERNEL32(zhuomian,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402353
                                                                                                                                                                                        • RegSetValueExA.KERNEL32(?,?,?,?,zhuomian,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238C
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,zhuomian,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                        • String ID: zhuomian
                                                                                                                                                                                        • API String ID: 1356686001-4173391253
                                                                                                                                                                                        • Opcode ID: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                        • Instruction ID: a02971d7ffc86f6f7c629cb7da59e84f0146b185ae6196f13f615d438ff22468
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e97c049d0962e353d409002bde4a9e7656888e749f4c97f255031353b2da08c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B1172B1E00108BFEB10AFA5DE8AEAF767CEB40748F10443AF505B71D1D7B99D019A68
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 004055D8
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
                                                                                                                                                                                        • SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\360wp\User Data,00000000,00000000,000000F0), ref: 00401622
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360wp\User Data, xrefs: 00401617
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360wp\User Data
                                                                                                                                                                                        • API String ID: 3751793516-1093102105
                                                                                                                                                                                        • Opcode ID: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                        • Instruction ID: 6d25d20538d6d8534b6823f3fc6f17b8a3ed29de71c0eeeb3a5295b4bc58004c
                                                                                                                                                                                        • Opcode Fuzzy Hash: a047e469b5a6af0523567b7bf6a07c2f69aa5230d17334b040e8c626c3e2ec92
                                                                                                                                                                                        • Instruction Fuzzy Hash: B6010431908150ABDB116FB55D44D7F6BB0EA52365728063FF491B22E2C23C8942D62E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405749 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 0040575C
                                                                                                                                                                                        • GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405776
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405749, 0040574C
                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian, xrefs: 00405750
                                                                                                                                                                                        • nsa, xrefs: 00405755
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                        • API String ID: 1716503409-4022813552
                                                                                                                                                                                        • Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                        • Instruction ID: 034d2fd5f9dd90bdc64dfe9fa05123f4a2a2f766a0f29b75e345e617da869bcc
                                                                                                                                                                                        • Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9CF0A736348204BADB104F55DC04B9B7F59DF91750F14C027FE449B1C0D6B1995897A5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402A28 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(?,?,00000000,?,?), ref: 00402A49
                                                                                                                                                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A85
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402A8E
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402AB3
                                                                                                                                                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AD1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1912718029-0
                                                                                                                                                                                        • Opcode ID: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                        • Instruction ID: 092ce5dc9ace931e83acbc3e972042597453fb0194ad27f06f99c48de557c256
                                                                                                                                                                                        • Opcode Fuzzy Hash: 117b1953dc72d94caf661699afc1c9fa4664a035d5756c11002a2b876640c8cc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C118971A00009FFDF21AF90DE48DAB7B39EB44384B004076BA01A01A0DB749E41EE69
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2F10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Valuelstrcmpi
                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                        • API String ID: 1914577711-2395435937
                                                                                                                                                                                        • Opcode ID: 10a6954aadb71ea60065dc3b679e8e0343c1d438348b8367318da85960a0d022
                                                                                                                                                                                        • Instruction ID: 84618b9130b00603b3158d9984ec10f0348074b872691baa22c2e75616360713
                                                                                                                                                                                        • Opcode Fuzzy Hash: 10a6954aadb71ea60065dc3b679e8e0343c1d438348b8367318da85960a0d022
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4341AF376483488BE7348928D800BFB77D0EBE1730F24896DE895C7240EF36544D8792
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100042B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?), ref: 10004344
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 3735805505-2398078204
                                                                                                                                                                                        • Opcode ID: ae8d182f79f2bfc1a7be0f87d09a4fce654424f02b224733c4aaf5a4d82723ba
                                                                                                                                                                                        • Instruction ID: da14d6f09df9c476e187c7044975134286627e28dc9b3e8c64bc06710fbf7309
                                                                                                                                                                                        • Opcode Fuzzy Hash: ae8d182f79f2bfc1a7be0f87d09a4fce654424f02b224733c4aaf5a4d82723ba
                                                                                                                                                                                        • Instruction Fuzzy Hash: C821ACB6C00208BBFF11DF958C85DDFBBBDEF05290F6040A6FA14A2115D7359E049BA4
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10003393 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                        • RegCreateKeyExW.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,?,10004440,00000000,Software\360WallPaper,00000000,00000000,00000000), ref: 1000340C
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Create$FreeGlobal
                                                                                                                                                                                        • String ID: Software\360WallPaper
                                                                                                                                                                                        • API String ID: 1366836192-3217021507
                                                                                                                                                                                        • Opcode ID: e8f8f166a8ed0e7c69ad6b0f2b36b80f7a6e9b7f677287450aa0db076d234df0
                                                                                                                                                                                        • Instruction ID: aa56ff811675d69e7919beffeeb5fe803cdf6dd7f71a7261d828bb87f28b6d50
                                                                                                                                                                                        • Opcode Fuzzy Hash: e8f8f166a8ed0e7c69ad6b0f2b36b80f7a6e9b7f677287450aa0db076d234df0
                                                                                                                                                                                        • Instruction Fuzzy Hash: DB11053200414ABFEF029F90EC45CEA3FAAFF4D2A4B114125FA0891124DB36E971AB90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405A43: lstrcpynA.KERNEL32(?,?,00000400,00403293,00423700,NSIS Error), ref: 00405A50
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 004055D8
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                          • Part of subcall function 004055CA: CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 0040566A
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 0040567A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                        • API String ID: 3248276644-3404278061
                                                                                                                                                                                        • Opcode ID: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                        • Instruction ID: 163ab709c3a69a1d20cf6f8253de986ede20969e143c641b36a5b73ea23f62c0
                                                                                                                                                                                        • Opcode Fuzzy Hash: b86ca621acbaa9e4c0a6121c3faa1626212e729a801e4ed9086ea3a93e8cda21
                                                                                                                                                                                        • Instruction Fuzzy Hash: F9F0F911205D5025C72222351C09AAF0A55CD623287990E3FF858B12D1CA3D8943DC6D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 1000341E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.KERNELBASE(00020019,00000000,-00000008,?,10003BDF,10027780,REG_DWORD,?,100038CF,00020019,00000000,-00000008,?,10003BDF,00000000,10003BDF), ref: 10003445
                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                        • RegOpenKeyExW.ADVAPI32(00020019,00000000,-00000008,?,10003BDF,?,100038CF,00020019,00000000,-00000008,?,10003BDF,00000000,10003BDF,?,-00000008), ref: 1000346D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Open$FreeGlobal
                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                        • API String ID: 355097715-3740793138
                                                                                                                                                                                        • Opcode ID: 07b7dc59b8ece281ad733227d2b9121c370f1dbd4f21f9b302e7c3dc98f75a48
                                                                                                                                                                                        • Instruction ID: 377d775a3d59cacce431edfbf9d8faf3fc6213752c062a16a90a449e4ddf95ac
                                                                                                                                                                                        • Opcode Fuzzy Hash: 07b7dc59b8ece281ad733227d2b9121c370f1dbd4f21f9b302e7c3dc98f75a48
                                                                                                                                                                                        • Instruction Fuzzy Hash: A2F01D3650015ABBEF029FA5EC058DB3F6AFF892E1B108021FA0C85124D732D9719B90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004031F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                        • CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00403212
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Char$Next$CreateDirectoryPrev
                                                                                                                                                                                        • String ID: 2052$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 4115351271-1217774910
                                                                                                                                                                                        • Opcode ID: 178f3fee0fe42fa6237002c0f83b77f0329cc0a1a68c82cc1b81573e38bf9039
                                                                                                                                                                                        • Instruction ID: 8509fc719cfacdd3e0f19311c8db3474c91ee7b64774067ccbe91e129429c82f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 178f3fee0fe42fa6237002c0f83b77f0329cc0a1a68c82cc1b81573e38bf9039
                                                                                                                                                                                        • Instruction Fuzzy Hash: 75D0A92160AD3036CA613B273C0AFCF090C8F0232DF2500BBF804B00C68B6C5A8218EF
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040643F Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                        • Instruction ID: 46f5cb6b99077c8a932221f6f95319a4d003604abf7c8fe4deea8dd62122f91f
                                                                                                                                                                                        • Opcode Fuzzy Hash: e2ec5e691eefeb7895a1ac387bd927eff239bfafd377499becc957e94103ad58
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1EA13371D00229CBEF28CFA8C8547ADBBB1FF44309F15856AD816BB281D7785A86DF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00406640 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                        • Instruction ID: b6d6ccc853a16e4f483ba8b04077c6698ffe39116f32d6ac079e48ce0b9a1d5b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ec64765bbfe4fe864a44f2a148697461047da27e0e17663b57c602867936ff4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C912071D00229CBEF28CF98C844BADBBB1FF44305F15816AD816BB291D7789A86DF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00406356 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                        • Instruction ID: 9f2062d8dd3c72469bab0aaa0c4d472ca99449d25692711e554c959146fb5a05
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7eb68f714ae239f9d96536ddefa0b0130c78a53d72885ed6635004d34bb0e1c3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F812471D00229CFEF24CFA9C8447AEBBB1FB44305F25816AD816BB281C7789985DF55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405E5B Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                        • Instruction ID: 84f98c36384fe8ee64262c0bd4aeca6ab0d9deaaf6f503267966aff3759d9c01
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2482ce101b79804f74797cf326f25a845d592d71d58d7df2a3bf49f74afb3583
                                                                                                                                                                                        • Instruction Fuzzy Hash: DB816672D04229CBEF24CFA9C8447AEBBB0FF44305F25816AD856B7281C7785A86DF54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004062A9 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                        • Instruction ID: 87842c1f76f394e9967038b09935c6923b6a3569bddc7a9db877803d8644aafd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e377961aab5915f676f277977e9088cd48e73eb1c2f96f4c26015d5a799a0d8
                                                                                                                                                                                        • Instruction Fuzzy Hash: BE711171D00229CFEF28CF98C844BADBBB1FB48305F15806AD816B7281D7789996DF54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004063C7 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                        • Instruction ID: f29c7650ca7732be42b715054819f9ef2f9a8d26a50ddb16a6e1c9f426a403c7
                                                                                                                                                                                        • Opcode Fuzzy Hash: ce8f1a48a343de5ee94cf1d77394f6fa9a4da1696e9cf57581d11998677c295c
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6712271E00229CBEF28CF99C844BAEBBB1FB44305F15806AD816B7281C7789996DF55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00406313 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                        • Instruction ID: 150ce1bc09a2c7df66eb9a1793004520446428f7a11f196e4037732027db8909
                                                                                                                                                                                        • Opcode Fuzzy Hash: cfd3b2ec3f5e172a28ac146294ee31ecb58d2767ae15e01e397df032d3a520fc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 31712371D00229CBEF28CF98C844BAEBBB1FF44305F15806AD816B7291C7789A96DF44
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401B06 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalFree.KERNEL32(005974E0), ref: 00401B75
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                        • String ID: tY
                                                                                                                                                                                        • API String ID: 3394109436-3184902462
                                                                                                                                                                                        • Opcode ID: 7c171d38e55c0da398560173357857eab17de6338ff8b470059d307903f45737
                                                                                                                                                                                        • Instruction ID: 474fb9bf02499c7a6170e06d53d4e3f45d0768bb224d9c97df738da83c32a5d1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c171d38e55c0da398560173357857eab17de6338ff8b470059d307903f45737
                                                                                                                                                                                        • Instruction Fuzzy Hash: C8219376A04500ABCB10EBA49EC5E5F73A8EB84318B24853BF211B72D1D778E9418F5D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040592A Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(80000002,00405B62,00000000,00000002,?,00000002,?,?,00405B62,80000002,Software\Microsoft\Windows\CurrentVersion,?,zhuomian,?), ref: 00405953
                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(?,?,00000000,00405B62,?,00405B62), ref: 00405974
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00405995
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                        • Opcode ID: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
                                                                                                                                                                                        • Instruction ID: 36589d6fa93a219f8bc047707fd62eb4045adffcbf025e375e54fe90c3c214b0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 20ca1dc64cf80f35bde4a5a459f169022cfe0f17446037da1f5ac97088a586f8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 100148B104020AEFDB128F65EC44AEB7FACEF143A4F004426FD44A6160D235D964DFA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405D61 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D73
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(?,?,00000000,00403268,00000008), ref: 00405D7E
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00405D8F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 310444273-0
                                                                                                                                                                                        • Opcode ID: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                        • Instruction ID: 632a00fb12e3cb8d7b800c8c05c00ea1272b68564f45bf1eadf202890d1355d3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 97ddaf2e4b1b42c8b778ecf4f1808cbc671853c9cd891f7a204fe98fd5c266cc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AE08C32A04611ABC7115B20AD0897B73A8EED9B41304493EF909F6290D734AC11ABBA
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004035A6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035B8
                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00000000,00403416,00000000), ref: 004035CC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\, xrefs: 004035D7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\
                                                                                                                                                                                        • API String ID: 2962429428-203276980
                                                                                                                                                                                        • Opcode ID: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                        • Instruction ID: f9564199049be1f32d817ae5fae54506e28515e34a5cdd4db7d8b8eaa5d9f10b
                                                                                                                                                                                        • Opcode Fuzzy Hash: e791c43d3f2c15357cd5853a26efddeddf9909534bf99fde0ed9ff0c6461a485
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE0C230904A10A6C630AF3CBE499063A6C6B413317244B26F174F21F1C778AE428AA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100048B1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10003393: RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 1000491F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateFreeGlobal
                                                                                                                                                                                        • String ID: Software\360WallPaper
                                                                                                                                                                                        • API String ID: 2564295761-3217021507
                                                                                                                                                                                        • Opcode ID: b91314f91aa304db9247177ad946028b29e8f64a40d817af18a68822f9e79358
                                                                                                                                                                                        • Instruction ID: 605d8d1225a9b23038807ad8a28179a2e71f871007bc0d5f9e86542fed4c56d6
                                                                                                                                                                                        • Opcode Fuzzy Hash: b91314f91aa304db9247177ad946028b29e8f64a40d817af18a68822f9e79358
                                                                                                                                                                                        • Instruction Fuzzy Hash: 70118076900108BBEB11DF86CD45CDF7FBDEF8A390F100065FA04A212ADB319A15DBA0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004023A1 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(00000000,00000000,?,000003FF,?,?,?,?,00000033), ref: 004023D1
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,zhuomian,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                        • Opcode ID: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                        • Instruction ID: 761649a6a3df08df281199264971948c500f78b60f5aa5b2cb2b090958000ad5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 78f62e18bb15f2844ae02dff0c90b37e58c1f10f0c3f36eda017ef64f89221b9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 85118271A05205EFDB15CFA4CA4C9AE7BB4EF10354F20807FE441B72C0D6B88A45EB26
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C442C Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetVersion.KERNEL32(021C4545,?,?,?), ref: 021C4439
                                                                                                                                                                                          • Part of subcall function 021C61F2: HeapCreate.KERNEL32(00000000,00001000,00000000,021C444B,00000001), ref: 021C6203
                                                                                                                                                                                          • Part of subcall function 021C61F2: HeapDestroy.KERNEL32 ref: 021C6242
                                                                                                                                                                                          • Part of subcall function 021C757C: TlsAlloc.KERNEL32(?,021C4483), ref: 021C7582
                                                                                                                                                                                          • Part of subcall function 021C757C: TlsSetValue.KERNEL32(00000000), ref: 021C75AA
                                                                                                                                                                                          • Part of subcall function 021C757C: GetCurrentThreadId.KERNEL32 ref: 021C75BB
                                                                                                                                                                                        • GetCommandLineA.KERNEL32 ref: 021C4490
                                                                                                                                                                                          • Part of subcall function 021C624F: VirtualFree.KERNEL32(?,00100000,00004000,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C6287
                                                                                                                                                                                          • Part of subcall function 021C624F: VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C6292
                                                                                                                                                                                          • Part of subcall function 021C624F: HeapFree.KERNEL32(00000000,?,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C629F
                                                                                                                                                                                          • Part of subcall function 021C624F: HeapFree.KERNEL32(00000000,?,?,?,?,021C44F1,021C4545,?,?,?), ref: 021C62BB
                                                                                                                                                                                          • Part of subcall function 021C624F: HeapDestroy.KERNELBASE(?,?,021C44F1,021C4545,?,?,?), ref: 021C62EE
                                                                                                                                                                                          • Part of subcall function 021C7668: TlsGetValue.KERNEL32(FFFFFFFF,?,021C44FE,00000000,021C4545,?,?,?), ref: 021C7680
                                                                                                                                                                                          • Part of subcall function 021C7668: TlsSetValue.KERNEL32(00000000,?,021C44FE,00000000,021C4545,?,?,?), ref: 021C7700
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Heap$Free$Value$DestroyVirtual$AllocCommandCreateCurrentLineThreadVersion
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1348591257-0
                                                                                                                                                                                        • Opcode ID: 4eaafae7304c664cc1f779c2d975af71888826e5757b8f88fcc7164541ed4094
                                                                                                                                                                                        • Instruction ID: 2a9630e8c905390818bd0c63da9c9311ab79e6a87e09a0bef1fcdc0f41620e73
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4eaafae7304c664cc1f779c2d975af71888826e5757b8f88fcc7164541ed4094
                                                                                                                                                                                        • Instruction Fuzzy Hash: E911337DDCB611CEDB247B70A51562AB7E9EB703017700C7ED115C5284DB7485A1CE53
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                        • Opcode ID: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                        • Instruction ID: d0f03140fbd629d0c0bf1accbe8acf671ec28544698acb2ee9a16026c0f47d2e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 18137a70c22b749d39bccb436dc6796159a3b95e775cc2a49cfd2400c12a7dbd
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F01F431B24210ABE7295B389D04B2A36ADE710315F10423BF855F66F1D67CDC028B4D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402299 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 00402AF2: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                        • RegDeleteValueA.KERNEL32(00000000,00000000,00000033), ref: 004022B8
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 004022C1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseDeleteOpenValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 849931509-0
                                                                                                                                                                                        • Opcode ID: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                        • Instruction ID: c96301186d0cc23108267263ea3d95e678ff255433b24e802bfd10008ffd0a7a
                                                                                                                                                                                        • Opcode Fuzzy Hash: ac5a88173e1113af7eaba8721edd8fafd12a85727df728674730d155b0c16ca5
                                                                                                                                                                                        • Instruction Fuzzy Hash: C7F06273B00110ABDB20BBE59F4EAAE6268AB40355F10453FF101B71D1DAFD8D41976E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C61F2 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapCreate.KERNEL32(00000000,00001000,00000000,021C444B,00000001), ref: 021C6203
                                                                                                                                                                                          • Part of subcall function 021C60AA: GetVersionExA.KERNEL32 ref: 021C60C9
                                                                                                                                                                                        • HeapDestroy.KERNEL32 ref: 021C6242
                                                                                                                                                                                          • Part of subcall function 021C62F7: HeapAlloc.KERNEL32(00000000,00000140,021C622B,000003F8), ref: 021C6304
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Heap$AllocCreateDestroyVersion
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2507506473-0
                                                                                                                                                                                        • Opcode ID: 9a6a8a53458bf3c57e6b841c7a2160ea82dce58bcddf7ac1899f9281be3c9098
                                                                                                                                                                                        • Instruction ID: 4bc5b75ca5fa7c5c0bb07a2a783922eb727316c21defc7dc0fdd8d06b9022c2f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a6a8a53458bf3c57e6b841c7a2160ea82dce58bcddf7ac1899f9281be3c9098
                                                                                                                                                                                        • Instruction Fuzzy Hash: 85F06578AD2381AADB205B34B80573B3BDDEBD0752F30493EF545C9088EBB4C0E19501
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040571A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000003,00402C9E,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 0040571E
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405740
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                        • Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                        • Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004056FB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(?,00405506,?,?,?), ref: 004056FF
                                                                                                                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405711
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                        • Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                        • Instruction ID: 1a0f39e157c28011d0f8c1384ae394ffa0e61bdf00c6ebf87dc07efa44195b5a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 16C04CB1818506ABD6056B24DF0D81F7B66EF90321B108B35F569E00F0C7355C66EE1A
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C3EE5 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,?,?,?,021D2E77), ref: 021C3FCC
                                                                                                                                                                                          • Part of subcall function 021C556E: InitializeCriticalSection.KERNEL32(00000000,?,00000010,?,021C3F7E,00000009,?,?,021D2E77), ref: 021C55AB
                                                                                                                                                                                          • Part of subcall function 021C556E: EnterCriticalSection.KERNEL32(00000010,00000010,?,021C3F7E,00000009,?,?,021D2E77), ref: 021C55C6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalSection$AllocateEnterHeapInitialize
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1616793339-0
                                                                                                                                                                                        • Opcode ID: fbe2e4b64d13413af8d21a0db3902583fce5072a0491b751b4b6e6e50d8998bc
                                                                                                                                                                                        • Instruction ID: c574fb4e8822035184d072370f85c16915bbd70549942d2ea235de67fc26c850
                                                                                                                                                                                        • Opcode Fuzzy Hash: fbe2e4b64d13413af8d21a0db3902583fce5072a0491b751b4b6e6e50d8998bc
                                                                                                                                                                                        • Instruction Fuzzy Hash: A421F935AC4204BBDB10DF64E841B9EF7B5EB10724F34895DF435EB2C0C77499418A55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402AF2 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B1A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                        • Opcode ID: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                        • Instruction ID: 62d85545fb8c015d315058fdcb0d0d57892fb31d87e90ba3457693cc688901e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 26ed417d2312a749cc05f3ddd6764c243c22a60ffc9109705d3c848113297493
                                                                                                                                                                                        • Instruction Fuzzy Hash: 46E086B6240108BFDB00DFA4ED47F9577ECF704301F004421B608D70A2C774E5408B58
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004031A8 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ReadFile.KERNEL32(00409190,00000000,00000000,00000000,004130A0,0040B0A0,004030AD,004130A0,00004000,?,00000000,?,00402F37,00000004,00000000,00000000), ref: 004031BF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                        • Opcode ID: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                        • Instruction ID: b8f1ad64850fa721b7c3123cc302f733781f6218d307da9d2aa6486ecc23217a
                                                                                                                                                                                        • Opcode Fuzzy Hash: b55c46bdf794a51955d6c22ef273c930d40ecd644cbb4da6e13cbea0766faea3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BE08632254119BBCF105E619C00AD73F5CEB0A3A2F008432FD55E9190D230EA11DBA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C75D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 021C5502: DeleteCriticalSection.KERNEL32(00000000,?,?,021C75D5,021C44EC,021C4545,?,?,?), ref: 021C5536
                                                                                                                                                                                          • Part of subcall function 021C5502: DeleteCriticalSection.KERNEL32(?,?,021C75D5,021C44EC,021C4545,?,?,?), ref: 021C5551
                                                                                                                                                                                          • Part of subcall function 021C5502: DeleteCriticalSection.KERNEL32 ref: 021C5559
                                                                                                                                                                                          • Part of subcall function 021C5502: DeleteCriticalSection.KERNEL32 ref: 021C5561
                                                                                                                                                                                          • Part of subcall function 021C5502: DeleteCriticalSection.KERNEL32 ref: 021C5569
                                                                                                                                                                                        • TlsFree.KERNEL32(FFFFFFFF,021C44EC,021C4545,?,?,?), ref: 021C75E0
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalDeleteSection$Free
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1584690612-0
                                                                                                                                                                                        • Opcode ID: eefe7daa1234539b4cd6fb0107294241ba7851ffe8e89d37432a6de2ea63e9b6
                                                                                                                                                                                        • Instruction ID: 8aaf0a232483e8d01df21cb9088ecc00680cb9eae885ee0cdc71a123efd0a0a5
                                                                                                                                                                                        • Opcode Fuzzy Hash: eefe7daa1234539b4cd6fb0107294241ba7851ffe8e89d37432a6de2ea63e9b6
                                                                                                                                                                                        • Instruction Fuzzy Hash: F4C04C78982640ABC6145678A54A50A36A676523743F40F04E0B7D11E0E76894A28E00
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004031DA Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E86,?), ref: 004031E8
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                        • Opcode ID: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                        • Instruction ID: 0cdacc43d416a0c3c320ce55ce8d4373a9ea66752a7e2c64ddc4eeaf6ba3fa4d
                                                                                                                                                                                        • Opcode Fuzzy Hash: a4f108b6483d59a247dd719aa3338c70368b303c79d310cc125f674897935547
                                                                                                                                                                                        • Instruction Fuzzy Hash: 49B01271644200BFDA214F00DF05F057B31B790700F108430B394380F082712420EB0D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                        Function 00404730 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404747
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404754
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 004047A0
                                                                                                                                                                                        • LoadBitmapA.USER32(0000006E), ref: 004047B3
                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000FC,00404D31), ref: 004047CD
                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004047E1
                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004047F5
                                                                                                                                                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 0040480A
                                                                                                                                                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404816
                                                                                                                                                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404828
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 0040482D
                                                                                                                                                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404858
                                                                                                                                                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404864
                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 004048F9
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404924
                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404938
                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404967
                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404975
                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404986
                                                                                                                                                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A89
                                                                                                                                                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404AEE
                                                                                                                                                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404B03
                                                                                                                                                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404B27
                                                                                                                                                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404B4D
                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404B62
                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00404B72
                                                                                                                                                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404BE2
                                                                                                                                                                                        • SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C8B
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C9A
                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404CBA
                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00404D08
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404D13
                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00404D1A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                        • API String ID: 1638840714-813528018
                                                                                                                                                                                        • Opcode ID: bc9dc24ba24aefd25b5204966072fec4a33e7f324add771e9c8dcad7f4caa963
                                                                                                                                                                                        • Instruction ID: 2f002745dd727b88aea6b3014e5fe59d6d497abb36422f7ee26b5b217c9fe0ee
                                                                                                                                                                                        • Opcode Fuzzy Hash: bc9dc24ba24aefd25b5204966072fec4a33e7f324add771e9c8dcad7f4caa963
                                                                                                                                                                                        • Instruction Fuzzy Hash: 83028BB0A40209EFDB24DF64DD45AAE7BB5FB84315F10813AF610BA2E1C7799A41CF58
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C3560 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 217stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 021C35E7
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000001), ref: 021C360D
                                                                                                                                                                                        • WinVerifyTrust.WINTRUST(000000FF,00AAC56B,?,?,00000001), ref: 021C3657
                                                                                                                                                                                        • WTHelperProvDataFromStateData.WINTRUST(?,000000FF,00AAC56B,?,?,00000001), ref: 021C366B
                                                                                                                                                                                        • WTHelperGetProvSignerFromChain.WINTRUST(00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,?,00000001), ref: 021C3678
                                                                                                                                                                                        • WTHelperGetProvCertFromChain.WINTRUST(00000000,00000000,00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,?,00000001), ref: 021C3685
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FromHelperProv$ChainData$ByteCertCharMultiSignerStateTrustVerifyWidelstrlen
                                                                                                                                                                                        • String ID: ,$A0$O$O
                                                                                                                                                                                        • API String ID: 3359820040-3593575299
                                                                                                                                                                                        • Opcode ID: 78401e6594ee4990c583ed95c87b493a63b6ecd138ec4ddd97f54a8da573b5b6
                                                                                                                                                                                        • Instruction ID: 968341b433267e43dba1c53b46ab5aa22065bd0f2d3135b8c23c02c8c4e2a330
                                                                                                                                                                                        • Opcode Fuzzy Hash: 78401e6594ee4990c583ed95c87b493a63b6ecd138ec4ddd97f54a8da573b5b6
                                                                                                                                                                                        • Instruction Fuzzy Hash: FA81D375900349AFDB20DFA8DC44BDEBBB5EF95320F24825DE425AB380D7708A45CBA1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C3230 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82memoryfileencryptionCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,021D2E7C,021D2E78,021C382C,?,?,?,?,?), ref: 021C3246
                                                                                                                                                                                        • LocalAlloc.KERNEL32(00000040,00000064,021D2E78,?,00000000,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C326E
                                                                                                                                                                                        • CryptCATAdminCalcHashFromFileHandle.WINTRUST(?,?,00000000,00000000,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C3289
                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C3292
                                                                                                                                                                                        • LocalFree.KERNEL32(00000000,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C32A4
                                                                                                                                                                                        • LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C32B2
                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C32CE
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Local$AllocFileHandle$AdminCalcCloseCreateCryptErrorFreeFromHashLast
                                                                                                                                                                                        • String ID: d
                                                                                                                                                                                        • API String ID: 1027636831-2564639436
                                                                                                                                                                                        • Opcode ID: c4da2d098a54f03856bbc6cd4607f11b657b1473f7e3315df387727e388cd0e2
                                                                                                                                                                                        • Instruction ID: 3cdde55b8da90c42a8a5efac5848b2a212d7a397d08981386d56897317b21e9a
                                                                                                                                                                                        • Opcode Fuzzy Hash: c4da2d098a54f03856bbc6cd4607f11b657b1473f7e3315df387727e388cd0e2
                                                                                                                                                                                        • Instruction Fuzzy Hash: B121C17A6853519BE720CFA8E840F1BB7E5FB98720F31895DF62597284CB70D811CBA1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C1F40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 021C1F97
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 021C1FD4
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021C1FDF
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021C20BD
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandle$ControlCreateDeviceFile
                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                        • API String ID: 1755752497-2935326385
                                                                                                                                                                                        • Opcode ID: 8c2ad67905c793ce429940eaae990f99d812579c34b86ef3d7f00ad5c034b4db
                                                                                                                                                                                        • Instruction ID: 1aa40cab8820eced232c7387f9dd950db3a375a1d8dca7486d3c90a632b8f221
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c2ad67905c793ce429940eaae990f99d812579c34b86ef3d7f00ad5c034b4db
                                                                                                                                                                                        • Instruction Fuzzy Hash: 82418F392C8344AFE320CE24DC40BABB7D5EBA0724F20482DF994972C1E775D51AC752
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2480 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,?), ref: 021C24C2
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 021C2505
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 021C2540
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021C25CD
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ControlDevice$CloseCreateFileHandle
                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                        • API String ID: 1375849437-2935326385
                                                                                                                                                                                        • Opcode ID: 8362b634551f8007eae497ea52ab5fe81e3805c00f1cc6bf6afcbce5fcd5da62
                                                                                                                                                                                        • Instruction ID: 42a8e190636e81f67b154f5fdee860070e85100c1b37ca53327561d38a8434e9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8362b634551f8007eae497ea52ab5fe81e3805c00f1cc6bf6afcbce5fcd5da62
                                                                                                                                                                                        • Instruction Fuzzy Hash: 54417D756843006BE330DE18DC51FAB7BD4EFA5714F20492CF9546B1C0D7B5A509CBA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2300 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,021C2B7B,?,00000064), ref: 021C235D
                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 021C23B8
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 021C2436
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                        • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                        • API String ID: 33631002-2935326385
                                                                                                                                                                                        • Opcode ID: 671ce6ba8e2941f482dcbb6811e8448072f4d17c9b411be2410dc49f156bf1c0
                                                                                                                                                                                        • Instruction ID: 52a9c6e6605ad4bfd5ef3920581175a8c4f14815daeb7a4438919a4645438d4c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 671ce6ba8e2941f482dcbb6811e8448072f4d17c9b411be2410dc49f156bf1c0
                                                                                                                                                                                        • Instruction Fuzzy Hash: DF41E5755443409FE731CF18C880EABB7E9FBD8724F640D2DF99897280DB7099998B62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C37D0 Relevance: 6.1, APIs: 4, Instructions: 73encryptionCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CryptCATAdminAcquireContext.WINTRUST(021D2E7C,00000000,00000000,?,?,?,021D2E78,021C105F,?), ref: 021C37E5
                                                                                                                                                                                        • CryptCATAdminEnumCatalogFromHash.WINTRUST(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,021D2E78,021C105F,?), ref: 021C383F
                                                                                                                                                                                        • CryptCATAdminReleaseCatalogContext.WINTRUST(?,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,?), ref: 021C3853
                                                                                                                                                                                        • LocalFree.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,021D2E78,021C105F), ref: 021C385D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AdminCrypt$CatalogContext$AcquireEnumFreeFromHashLocalRelease
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4198237086-0
                                                                                                                                                                                        • Opcode ID: 5284ea2b61ebe3ba8a33b67940727bebeb75901763acdfdacfa081dd4ab144e7
                                                                                                                                                                                        • Instruction ID: 9de7314cefa0c72e0e8bf45eae9aed7592cd280a965b941b3a93bb0fad8b55c3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5284ea2b61ebe3ba8a33b67940727bebeb75901763acdfdacfa081dd4ab144e7
                                                                                                                                                                                        • Instruction Fuzzy Hash: CD118FBA3442066FE614DA59DC80F6BF3ADEFA4365F20853EFA51C2140EB61E8458A70
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C3210 Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CryptCATAdminReleaseContext.WINTRUST(?,00000000), ref: 021C3220
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AdminContextCryptRelease
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3084080992-0
                                                                                                                                                                                        • Opcode ID: b399d778339a3b8aba0cf666fccde982aadb57a0d18854f6cdf17dab1362814b
                                                                                                                                                                                        • Instruction ID: 4f4b4b56100c360b177a4b980c7b2ab7ddf463e752e6bc03bc90b59c1750c66f
                                                                                                                                                                                        • Opcode Fuzzy Hash: b399d778339a3b8aba0cf666fccde982aadb57a0d18854f6cdf17dab1362814b
                                                                                                                                                                                        • Instruction Fuzzy Hash: EDB0927C3822846AEA395F209E11B27A756AF61B29FB4C4EC500929098C737D0028A80
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404F1F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278windowclipboardmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 00404F7E
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00404F8D
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00404FCA
                                                                                                                                                                                        • GetSystemMetrics.USER32(00000015), ref: 00404FD2
                                                                                                                                                                                        • SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404FF3
                                                                                                                                                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405004
                                                                                                                                                                                        • SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405017
                                                                                                                                                                                        • SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405025
                                                                                                                                                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405038
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040505A
                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040506E
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040508F
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040509F
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004050B8
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004050C4
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00404F9C
                                                                                                                                                                                          • Part of subcall function 00403E6C: SendMessageA.USER32(00000028,?,00000001,00403C9D), ref: 00403E7A
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004050E1
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00004EB3,00000000), ref: 004050EF
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004050F6
                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040511A
                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040511F
                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405166
                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405198
                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004051A9
                                                                                                                                                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004051BE
                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 004051D1
                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004051F5
                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405230
                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405240
                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405246
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 0040524F
                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405259
                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040526D
                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405285
                                                                                                                                                                                        • SetClipboardData.USER32(00000001,00000000), ref: 00405290
                                                                                                                                                                                        • CloseClipboard.USER32 ref: 00405296
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                        • String ID: {
                                                                                                                                                                                        • API String ID: 590372296-366298937
                                                                                                                                                                                        • Opcode ID: 8ecacec262ee9c946a5dc1a8a4639b1463e14c3919ca1e3b64bff360b0e0cb3d
                                                                                                                                                                                        • Instruction ID: 54a7b5396bae693a6587d4a30afce820365ed4185083f78a013f57a3a1aa2e37
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ecacec262ee9c946a5dc1a8a4639b1463e14c3919ca1e3b64bff360b0e0cb3d
                                                                                                                                                                                        • Instruction Fuzzy Hash: FDA14A70900208BFDB219F60DD89AAE7F79FB04355F00417AFA05BA2A0C7795E519F99
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403964 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039A0
                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 004039BD
                                                                                                                                                                                        • DestroyWindow.USER32 ref: 004039D1
                                                                                                                                                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 004039ED
                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403A0E
                                                                                                                                                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A22
                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403A29
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403AD7
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403AE1
                                                                                                                                                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403AFB
                                                                                                                                                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B4C
                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403BF2
                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00403C13
                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C25
                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403C40
                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C56
                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00403C5D
                                                                                                                                                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C75
                                                                                                                                                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403C88
                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,?,00420500,00423700), ref: 00403CB1
                                                                                                                                                                                        • SetWindowTextA.USER32(?,00420500), ref: 00403CC0
                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 00403DF4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 184305955-0
                                                                                                                                                                                        • Opcode ID: 521e42e78b2c92cd1229cf199b8c668d2aaf7e2ddad680e485230a55364f8aca
                                                                                                                                                                                        • Instruction ID: 7ba81dbe19c60a8e0c3243ea337059b00a2b0f070469454242f3f43eb6e2cd92
                                                                                                                                                                                        • Opcode Fuzzy Hash: 521e42e78b2c92cd1229cf199b8c668d2aaf7e2ddad680e485230a55364f8aca
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36C1A271A04204BBD7206F61ED49E2B7EBCEB45706F40053EF541B12E1C779AA429F6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403F7F Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204windowstringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040400A
                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 0040401E
                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040403C
                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040404D
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040405C
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040406B
                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 00404075
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404083
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404092
                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 004040F5
                                                                                                                                                                                        • SendMessageA.USER32(00000000), ref: 004040F8
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404123
                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404163
                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 00404172
                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040417B
                                                                                                                                                                                        • ShellExecuteA.SHELL32(0000070B,open,00422EA0,00000000,00000000,00000001), ref: 0040418E
                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 0040419B
                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040419E
                                                                                                                                                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 004041CA
                                                                                                                                                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 004041DE
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                        • String ID: K?@$N$open$zhuomian
                                                                                                                                                                                        • API String ID: 3615053054-1962824091
                                                                                                                                                                                        • Opcode ID: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                        • Instruction ID: a34f9f388cf178df8091a403f6a11dec50c515965b2aee4463b3b7977a12a790
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7846a1e8646d4b41dbec8b8b7e88b314b502ca15eec115b00dc6cfc0ac1c380e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5461C2B1A40209BFEB109F60DD45B6A7BA9FB54705F108136FB04BA2D1C7B8A951CF98
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100038D4 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 234registrymemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00010960), ref: 100038F7
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                        • FindWindowExA.USER32(?,00000000,#32770,00000000), ref: 10003B3D
                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003EE), ref: 10003B52
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 10003BF1
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10003C10
                                                                                                                                                                                          • Part of subcall function 10002C7B: GlobalAlloc.KERNEL32(00000040,00000808,REG_DWORD,10027780,10003020,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?), ref: 10002C96
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Global$AllocFree$ByteCharCloseFindItemMultiWideWindow
                                                                                                                                                                                        • String ID: #32770$/B=$/G=$/K=$/N=$/NI=$/NS=$/S=$/T=$/V=$REG_DWORD
                                                                                                                                                                                        • API String ID: 3499353900-2394764689
                                                                                                                                                                                        • Opcode ID: 4e48371105ca142b6d9544845e2a5454876a24b9921edead1c57e13581c50ac4
                                                                                                                                                                                        • Instruction ID: 365e6f5f25b1f83e1dd00ba1fd5339e23cab235de8553f25a2c5091953fb1571
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4e48371105ca142b6d9544845e2a5454876a24b9921edead1c57e13581c50ac4
                                                                                                                                                                                        • Instruction Fuzzy Hash: F0818BB5D01254EFF301DB26CC89EAB37E8FB492C4B01816AF94C9626BC775A841CB31
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021CA870 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 230filememoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,?), ref: 021CA8B6
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 021CA8E0
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 021CA912
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,000000F8,00000040,00000000), ref: 021CA93A
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 021CA983
                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 021CA999
                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 021CA9B2
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,000000F8,000000F8,00000000), ref: 021CA9CA
                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 021CA9D7
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021CA9DE
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021CA9F8
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Read$CloseHandlePointerVirtual$AllocCreateFreeSize
                                                                                                                                                                                        • String ID: @$MZ$PE
                                                                                                                                                                                        • API String ID: 190504658-3267401838
                                                                                                                                                                                        • Opcode ID: 362e19e9bf46acc2eff1a0bb09a6988be8ad514978054df53a827affe4544f07
                                                                                                                                                                                        • Instruction ID: 21f0259e0b2e225cef9eb4221c963c44bee7ff8b28034a6d14ae0711aac1592f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 362e19e9bf46acc2eff1a0bb09a6988be8ad514978054df53a827affe4544f07
                                                                                                                                                                                        • Instruction Fuzzy Hash: 16916FB5D802189FEB25CF18CC41BEAB7B8FF59B10F24819EE509A7290D7705A81CF91
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                        • DrawTextA.USER32(00000000,00423700,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                        • Opcode ID: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                        • Instruction ID: ae885c784bcfecf2f3eb694ec281fa6ca416ae0fe75479e663ed1437ea50fae5
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c3e4e083806f80561305df6aa162db85e31547ab03d1642c9c86c85032b3f2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B419A71804249AFCB058FA5DD459BFBFB9FF44315F00812AF951AA1A0C738AA50DFA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404275 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 242stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 004042C0
                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,?), ref: 004042EC
                                                                                                                                                                                        • SHBrowseForFolderA.SHELL32(?,0041F8D0,?), ref: 004043A1
                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 004043AC
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(zhuomian,00420500), ref: 004043DE
                                                                                                                                                                                        • lstrcatA.KERNEL32(?,zhuomian), ref: 004043EA
                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 004043FA
                                                                                                                                                                                          • Part of subcall function 004052E8: GetDlgItemTextA.USER32(?,?,00000400,00404430), ref: 004052FB
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                          • Part of subcall function 00405CA1: CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                        • GetDiskFreeSpaceA.KERNEL32(0041F4C8,?,?,0000040F,?,00000000,0041F4C8,0041F4C8,?,?,000003FB,?), ref: 0040449D
                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044B3
                                                                                                                                                                                        • SetDlgItemTextA.USER32(00000000,00000400,0041F4B8), ref: 00404507
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
                                                                                                                                                                                        • String ID: 59cd53708ed730f0ef42bb01f668d936$A$C:\Users\user\AppData\Roaming\360bizhi$zhuomian
                                                                                                                                                                                        • API String ID: 2246997448-1175814829
                                                                                                                                                                                        • Opcode ID: af730459850d39b60bbf0d54f0c3d7c5c821983bb6905d82adcfe294716d2a84
                                                                                                                                                                                        • Instruction ID: 735228c1dd8b1f81b04b8bc6f92d9a1389f0a941abf34816bf15e20d5babff8a
                                                                                                                                                                                        • Opcode Fuzzy Hash: af730459850d39b60bbf0d54f0c3d7c5c821983bb6905d82adcfe294716d2a84
                                                                                                                                                                                        • Instruction Fuzzy Hash: B7817DB1A00218BBDB11AFA1DD45A9F7BB8EF44314F10813BFA04B62D1C77C9A41CB69
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2600 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164registrystringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?), ref: 021C2643
                                                                                                                                                                                        • RegEnumKeyExA.ADVAPI32(?,?,?,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 021C2685
                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?,?,?), ref: 021C26A8
                                                                                                                                                                                        • RegQueryValueExA.ADVAPI32(?,?,?,?,?,ServiceName,00000000,?,?,?), ref: 021C26E0
                                                                                                                                                                                        • lstrcmpA.KERNEL32(?,?,?,?,?), ref: 021C2727
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,?,?,?,ServiceName,00000000,?,?,?), ref: 021C2763
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 021C2777
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • ServiceName, xrefs: 021C26CE
                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 021C2639
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseOpen$EnumQueryValuelstrcmp
                                                                                                                                                                                        • String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
                                                                                                                                                                                        • API String ID: 2703301734-1795789498
                                                                                                                                                                                        • Opcode ID: 085e23630eba8f81be0e5819c62ebf3bf74d208cb11119ccbd8f5b3005a42755
                                                                                                                                                                                        • Instruction ID: dbd56dfd4c84acaab45124368bb408c5ec2ea1d311db410bc3d190404df060ec
                                                                                                                                                                                        • Opcode Fuzzy Hash: 085e23630eba8f81be0e5819c62ebf3bf74d208cb11119ccbd8f5b3005a42755
                                                                                                                                                                                        • Instruction Fuzzy Hash: B151C4796883419FE720CE28D880BABB7E8ABA4714F14493DFDD8D7240EB31E505C762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2910 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Netbios
                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$* $2$3$7
                                                                                                                                                                                        • API String ID: 544444789-1802369251
                                                                                                                                                                                        • Opcode ID: 8226f79f884abbf890638a9035c4144abada9b0628f4c1f71924f3d11e2642aa
                                                                                                                                                                                        • Instruction ID: 1158d2efd306c1b2174dc3e53690aec51a63631b01b5660f3bbba854a1fee14f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8226f79f884abbf890638a9035c4144abada9b0628f4c1f71924f3d11e2642aa
                                                                                                                                                                                        • Instruction Fuzzy Hash: C931257564C381AFE716CB28C8107ABB7E5AFE9300F54886DB4D8C7251DB74C5098BA3
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C9BC9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • LoadLibraryA.KERNEL32(user32.dll,?,00000000,021D2E77,021C8005,?,Microsoft Visual C++ Runtime Library,00012010,?,021CD63C,?,021CD68C,?,?,?,Runtime Error!Program: ), ref: 021C9BDB
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 021C9BF3
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 021C9C04
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 021C9C11
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                        • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                                                                                                                        • API String ID: 2238633743-4044615076
                                                                                                                                                                                        • Opcode ID: 8461d825f4fa279e0ab77dfb4901ba08122940c3b0079b3af17ab6be83913d71
                                                                                                                                                                                        • Instruction ID: 6d8d9814b73336ceeae6f169be8036dedac55cbddf1bf7cf8d44a653491e052a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8461d825f4fa279e0ab77dfb4901ba08122940c3b0079b3af17ab6be83913d71
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9701B179BC3305DB9B159FB8AC8097B7BE8AAA4B94720087DB905D2101DB70C4A2CF65
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C55E4 Relevance: 13.7, APIs: 9, Instructions: 177COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • LCMapStringW.KERNEL32(00000000,00000100,021CD2FC,00000001,00000000,00000000,021D4E4C,00000100,?,?,021C2ECB,?,?,?,021CF150,?), ref: 021C5626
                                                                                                                                                                                        • LCMapStringA.KERNEL32(00000000,00000100,021CD2F8,00000001,00000000,00000000), ref: 021C5642
                                                                                                                                                                                        • LCMapStringA.KERNEL32(021CF150,?,?,?,021C2ECB,?,021D4E4C,00000100,?,?,021C2ECB,?,?,?,021CF150,?), ref: 021C568B
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000101,?,?,00000000,00000000,021D4E4C,00000100,?,?,021C2ECB,?,?,?,021CF150,?), ref: 021C56C3
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 021C571B
                                                                                                                                                                                        • LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 021C5731
                                                                                                                                                                                        • LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 021C5764
                                                                                                                                                                                        • LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 021C57CC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: String$ByteCharMultiWide
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 352835431-0
                                                                                                                                                                                        • Opcode ID: 6bf002f134fb705fdb1f6d9d8e174f859705f108481d71c46a928bee518d7f15
                                                                                                                                                                                        • Instruction ID: b8edc50c178a4b0db8ff011334ecfc82ffa43ff93c6f3e51025b5dd7ab21ace2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6bf002f134fb705fdb1f6d9d8e174f859705f108481d71c46a928bee518d7f15
                                                                                                                                                                                        • Instruction Fuzzy Hash: A1518B39980209FFCF228F58EC45A9F7FB6FB58754FA04129F921A1150C73198A0DFA1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C7EE1 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000010), ref: 021C7F4E
                                                                                                                                                                                        • GetStdHandle.KERNEL32(000000F4,021CD63C,00000000,?,00000000,00000010), ref: 021C8024
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000), ref: 021C802B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$HandleModuleNameWrite
                                                                                                                                                                                        • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                                                                                        • API String ID: 3784150691-4022980321
                                                                                                                                                                                        • Opcode ID: 336583716eecc200e51ffef4c4685055ba46bb1946fd64f63995f80b97bc594b
                                                                                                                                                                                        • Instruction ID: cb5f99729fa9aa14cc11afd26a39c02da326c40ceb3dfd2a5cd57dcfe17cbb4e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 336583716eecc200e51ffef4c4685055ba46bb1946fd64f63995f80b97bc594b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2731087AAC0218AEEF21E660DC89F9EB76DEB55300F30046EF559E2080D7B0D581CE51
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405CA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405CF9
                                                                                                                                                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00405D06
                                                                                                                                                                                        • CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D0B
                                                                                                                                                                                        • CharPrevA.USER32(?,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,C:\Users\user\AppData\Local\Temp\,00000000,004031FD,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405D1B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405CA2, 00405CDD
                                                                                                                                                                                        • "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian, xrefs: 00405CA7
                                                                                                                                                                                        • *?|<>/":, xrefs: 00405CE9
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 589700163-2009224355
                                                                                                                                                                                        • Opcode ID: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                        • Instruction ID: 5f153727bab28e9e0146d4b5ee00b331a23ca9fa80731b33480d586dfd6bff40
                                                                                                                                                                                        • Opcode Fuzzy Hash: aed88e6f7d133dc8fa8dfdf99e99c2a30466c3bd8babd3b523634b169c82fd89
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A119055808F912AFB3216245C44BB77F99CF567A0F28847BE5C4632C2C67C5C429B6E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C7D76 Relevance: 12.1, APIs: 8, Instructions: 132COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,021C44A0), ref: 021C7D91
                                                                                                                                                                                        • GetEnvironmentStrings.KERNEL32(?,?,?,?,021C44A0), ref: 021C7DA5
                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,021C44A0), ref: 021C7DD1
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,021C44A0), ref: 021C7E09
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,021C44A0), ref: 021C7E2B
                                                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,021C44A0), ref: 021C7E44
                                                                                                                                                                                        • GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,021C44A0), ref: 021C7E57
                                                                                                                                                                                        • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 021C7E95
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1823725401-0
                                                                                                                                                                                        • Opcode ID: 8628bbce6da4cbb487217fa8ca865d4acb78236ae280371666c33865be29c560
                                                                                                                                                                                        • Instruction ID: 8649a373d810b862be35f3431fa67e194061bf3e71023052eb0872ba416193cf
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8628bbce6da4cbb487217fa8ca865d4acb78236ae280371666c33865be29c560
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8F3106FB8C42555FD7203A74AC8493BFBDDEA69258731097DF561C7180E7A18C828E61
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403E9E Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000EB), ref: 00403EBB
                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 00403ED7
                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00403EE3
                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 00403EEF
                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 00403F02
                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00403F12
                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00403F2C
                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00403F36
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                        • Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                        • Instruction ID: 00f1469000c5a89127aeec98ef40b5380c975c6b17ce5fce2ee989e1a8c22914
                                                                                                                                                                                        • Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
                                                                                                                                                                                        • Instruction Fuzzy Hash: D9216271904745ABCB219F68DD08B5BBFF8AF01715B048A69F895E22E1C738E9048B55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100049D6 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 10004B0D
                                                                                                                                                                                          • Part of subcall function 10003393: RegCreateKeyExA.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,10027780,Software\360WallPaper,?,10004440,00000000,Software\360WallPaper), ref: 100033D0
                                                                                                                                                                                          • Part of subcall function 1000358F: RegSetValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,10027780,?,?,?,10004574,00000000,IsUserActive,00000000,00000000), ref: 100035D4
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 10004AE4
                                                                                                                                                                                          • Part of subcall function 10003656: RegDeleteValueA.ADVAPI32(?,00000000,IsUserActive,Software\360WallPaper,100049B0,00000000,IsUserActive), ref: 10003673
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Value$CloseQuery$ByteCharCreateDeleteFreeGlobalMultiWide
                                                                                                                                                                                        • String ID: IsUserActive$REG_DWORD$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 2191732953-2960318248
                                                                                                                                                                                        • Opcode ID: 4a879a8ff3d6c5e0ed0ecddff739f7783221a7412e1ec7e0ca8e9c89c1cdc9ac
                                                                                                                                                                                        • Instruction ID: 0d4dd0ca8cb0c1e017bd2fba6f78559ea720b6b1b0474100f72e102edfb4d539
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a879a8ff3d6c5e0ed0ecddff739f7783221a7412e1ec7e0ca8e9c89c1cdc9ac
                                                                                                                                                                                        • Instruction Fuzzy Hash: F2416DB6C00209BAFB11DB95CC45EDF7BBDEF59381F104065F608A211AD735AA40DB64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100037B1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 81COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 100031B1: SearchPathA.KERNEL32(00000000,00000000,00000000,00000104,?,00010000,?,00000000,REG_DWORD), ref: 10003202
                                                                                                                                                                                          • Part of subcall function 10003292: CreateProcessA.KERNEL32(?,?,10027780,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,10027780), ref: 10003315
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 1000385D
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 10003862
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseHandle$CreateFreeGlobalPathProcessSearch
                                                                                                                                                                                        • String ID: %s /s "%s"$D$IsUserActive$REG_DWORD$regedit.exe
                                                                                                                                                                                        • API String ID: 662912923-3176295603
                                                                                                                                                                                        • Opcode ID: a2c97a24effc0470d4fc4938de51915cf1c4d037391489e4e230d632c5e633a6
                                                                                                                                                                                        • Instruction ID: 0d107260ace9053c6934716935416cbdb4bcb4d79190a87c11232889ff830a0d
                                                                                                                                                                                        • Opcode Fuzzy Hash: a2c97a24effc0470d4fc4938de51915cf1c4d037391489e4e230d632c5e633a6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 761103728002187AFB02DB968C46EDF7B7EEF457C0F108025FA04B2019DB35A91186A5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404DE1 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                        • lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                        • lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                        • SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2531174081-0
                                                                                                                                                                                        • Opcode ID: 588ac7c460d5d31e4bcafe38edda76350f223ec5c49b888c00d63efa47534775
                                                                                                                                                                                        • Instruction ID: 2cf2fc7e43d6ef2041dab6756eebc4073d6c30a41a9daa52e20b0ba15f173232
                                                                                                                                                                                        • Opcode Fuzzy Hash: 588ac7c460d5d31e4bcafe38edda76350f223ec5c49b888c00d63efa47534775
                                                                                                                                                                                        • Instruction Fuzzy Hash: 94217CB1A00108BECB119FA5CD84ADFBFB9FB44354F14807AFA04A6290C3388E419F98
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004046B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004046CB
                                                                                                                                                                                        • GetMessagePos.USER32 ref: 004046D3
                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 004046ED
                                                                                                                                                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004046FF
                                                                                                                                                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404725
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                        • Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                        • Instruction ID: 0faaf10df4b3c5b013205b28b163586d08db614e614b64859ce527e54ea6c82f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D014071D00219BADB01DBA4DD45BEEBBB8AB55711F10412AFA10B71C0D7B469018B95
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402B2D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B48
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402B7C
                                                                                                                                                                                        • SetWindowTextA.USER32(?,?), ref: 00402B8C
                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402B9E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                        • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                        • API String ID: 1451636040-1158693248
                                                                                                                                                                                        • Opcode ID: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                        • Instruction ID: c2ae3dc6e7ef4d7981284b04d028e8b0241bece3c18d328e79a1d4abe5e5a81b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f61350f1e46929fc93301070d67415b54d08103db0c5dff667ea6911c87682c
                                                                                                                                                                                        • Instruction Fuzzy Hash: DBF01270900109ABEB219F50DD09BAE3779AB04345F00803AFA16B91D1D7B95A559B99
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10002E37 Relevance: 9.1, APIs: 6, Instructions: 130registrymemoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegEnumValueA.ADVAPI32(00000930,?,?,?,000006E8,?,00000000,00000930,?,00000000), ref: 10002E7C
                                                                                                                                                                                          • Part of subcall function 1000237C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000000,?,10003224,?,000000FF,00000000,?,IsUserActive,?,00000000), ref: 10002396
                                                                                                                                                                                        • RegEnumValueA.ADVAPI32(00000930,00000007,?,?,000006E8,?,?,10003FFD,?,?,?,?), ref: 10002EE1
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000930,?,?,?,?), ref: 10002EF6
                                                                                                                                                                                        • RegEnumValueA.ADVAPI32(00000930,00000001,?,?,000006E8,?,00000000,00000930,?,?,?,?), ref: 10002F1E
                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 10002F3B
                                                                                                                                                                                        • RegEnumValueW.ADVAPI32(00000930,?,00000000,?,000006E8,?,?,10003FFD), ref: 10002F7C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: EnumValue$Global$AllocByteCharFreeMultiWide
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 309017271-0
                                                                                                                                                                                        • Opcode ID: 1281734b4e71dc18fb74d1713490baceaa6a5fa52b8b3d6daad624339a5c763a
                                                                                                                                                                                        • Instruction ID: 1ed38f9154c17c2ae81838c918547a17f7f6db82f16b67f373f0d76d74db7595
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1281734b4e71dc18fb74d1713490baceaa6a5fa52b8b3d6daad624339a5c763a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7641B37690015EEFEF02CF94CC41AEEBBB9FB08384F014166FA15A2124E735DA659B50
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C8B9E Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetStringTypeW.KERNEL32(00000001,021CD2FC,00000001,?,00000100,00000001,?,?,?,00000000,00000000,?,021C23F1,?,?,00000001), ref: 021C8BDD
                                                                                                                                                                                        • GetStringTypeA.KERNEL32(00000000,00000001,021CD2F8,00000001,?,?,?,00000000,00000000,?,021C23F1,?,?,00000001,?), ref: 021C8BF7
                                                                                                                                                                                        • GetStringTypeA.KERNEL32(?,?,00000000,00000000,?,00000100,00000001,?,?,?,00000000,00000000,?,021C23F1,?,?), ref: 021C8C2B
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000002,00000000,00000000,00000000,00000000,00000100,00000001,?,?,?,00000000,00000000,?,021C23F1,?), ref: 021C8C63
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?), ref: 021C8CB9
                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 021C8CCB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: StringType$ByteCharMultiWide
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3852931651-0
                                                                                                                                                                                        • Opcode ID: 9d80c3ccde5d2349fa3c5871889df0ecf07dada412e55747920e56aa279390a8
                                                                                                                                                                                        • Instruction ID: 075cecc516b2369c643defa844c910537741b53b60f074cb94d6178cb82f4bc3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d80c3ccde5d2349fa3c5871889df0ecf07dada412e55747920e56aa279390a8
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C41A47A982219AFCF219F94DCC5DEF7FB9EB18750F210529F521D2140D7308961CB91
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2170 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 125fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 021C21B6
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 021C2232
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021C22D7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                        • String ID: SCSIDISK$\\.\Scsi%d:
                                                                                                                                                                                        • API String ID: 33631002-2176293039
                                                                                                                                                                                        • Opcode ID: e9a3c15e7db331dc36eeee258b659261bedda86ace2bf0b4752d3fe30e480aa4
                                                                                                                                                                                        • Instruction ID: 46a011d9f3aae33c2e22b96767ae8e89a2b476663b983befe5b1ae38eab406ee
                                                                                                                                                                                        • Opcode Fuzzy Hash: e9a3c15e7db331dc36eeee258b659261bedda86ace2bf0b4752d3fe30e480aa4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 494128755883409BE321CE54DC44F9BBBD4FBA4B14F20091DFD95AB2C1D7B4950AC792
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C60AA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetVersionExA.KERNEL32 ref: 021C60C9
                                                                                                                                                                                        • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 021C60FE
                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 021C615E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: EnvironmentFileModuleNameVariableVersion
                                                                                                                                                                                        • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                                                                                                                                                                                        • API String ID: 1385375860-4131005785
                                                                                                                                                                                        • Opcode ID: 86934c9125813482a341e07c2a07976ba41ac35ef7cde777f88be55c1a7dd081
                                                                                                                                                                                        • Instruction ID: 08c74d7e82582b5fabddfd708139b5a40a2e285a3c0b8814d808b32574535b82
                                                                                                                                                                                        • Opcode Fuzzy Hash: 86934c9125813482a341e07c2a07976ba41ac35ef7cde777f88be55c1a7dd081
                                                                                                                                                                                        • Instruction Fuzzy Hash: A8313579DC02C86EEB359670AC55BE93BAC9BE2319F3404EDD085D6243E731CA99CB11
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C2800 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?), ref: 021C283D
                                                                                                                                                                                        • DeviceIoControl.KERNEL32 ref: 021C287E
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 021C28F1
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                        • String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
                                                                                                                                                                                        • API String ID: 33631002-1525991222
                                                                                                                                                                                        • Opcode ID: 2455ef183e2a51d2538c3d51e202e6e0052faa02350bc932338ea617af140408
                                                                                                                                                                                        • Instruction ID: 192bc4ce82b2175c6000ff2621dec8c4b665c600fbd8af4bace8c26642720f51
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2455ef183e2a51d2538c3d51e202e6e0052faa02350bc932338ea617af140408
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0F21F5B66843026FE330DB18DC85FFB77E9DBD4B10F10893CBA9992284DB789545C662
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000), ref: 00402BDD
                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402BFB
                                                                                                                                                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402B2D,00000000), ref: 00402C4D
                                                                                                                                                                                          • Part of subcall function 00402BA9: MulDiv.KERNEL32(00000000,00000064,?), ref: 00402BBE
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402C29
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000,?), ref: 00404E1A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrlenA.KERNEL32(00402C3C,0041FCD8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C3C,00000000), ref: 00404E2A
                                                                                                                                                                                          • Part of subcall function 00404DE1: lstrcatA.KERNEL32(0041FCD8,00402C3C,00402C3C,0041FCD8,00000000,00000000,00000000), ref: 00404E3D
                                                                                                                                                                                          • Part of subcall function 00404DE1: SetWindowTextA.USER32(0041FCD8,0041FCD8), ref: 00404E4F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E75
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E8F
                                                                                                                                                                                          • Part of subcall function 00404DE1: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E9D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Windowlstrlen$CountCreateDestroyDialogParamTextTicklstrcatwsprintf
                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                        • API String ID: 632923820-2449383134
                                                                                                                                                                                        • Opcode ID: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                        • Instruction ID: f5379eef49564d08d05b70d449bc26bfa371e2d4fe50783bab2c047c33a3c2e3
                                                                                                                                                                                        • Opcode Fuzzy Hash: e90c32412a19d754f47535c6caf4665ea1ddf403cffc581e713ca8f8ad94a5a3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A01927090D225EBDB216F55EE4C99F7B78AB04701B104137F401B12D5C6BCA986CBAE
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10002964 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,10027780,000000FF,?,10004EF9,?,10004EF9,?,000000FF,10027780,00000000,?,00000000), ref: 1000297D
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,10027780,000000FF,REG_DWORD,00020000,00000000,00000000,Software\360WallPaper,?,10004EF9,?,000000FF,10027780,00000000,?), ref: 1000299E
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,REG_DWORD,00000000,?,10004EF9,?,10004EF9,?,000000FF,10027780,00000000,?,00000000), ref: 100029AF
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileWrite$ByteCharMultiWide
                                                                                                                                                                                        • String ID: REG_DWORD$Software\360WallPaper
                                                                                                                                                                                        • API String ID: 288293550-949188356
                                                                                                                                                                                        • Opcode ID: aae883a320d99f53fe983dc8287af01575469b74bc31c1813b52a1f6c8cb6a90
                                                                                                                                                                                        • Instruction ID: 57ac43b0a0119a90836e9a2894bcbb0978c006eb4cb8721f5ff92849ec4290ec
                                                                                                                                                                                        • Opcode Fuzzy Hash: aae883a320d99f53fe983dc8287af01575469b74bc31c1813b52a1f6c8cb6a90
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2DF0D47244012ABFEF019FA0EC49DEB3F6EFF08290B144114FA1985024C7329831EBA0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10001EAF Relevance: 7.9, APIs: 3, Strings: 2, Instructions: 382stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?,10027780,00000000,REG_DWORD), ref: 100020EF
                                                                                                                                                                                        • lstrlenW.KERNEL32(?,10027780,00000000,REG_DWORD), ref: 1000210C
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,10027780,00000000,REG_DWORD), ref: 10002159
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: lstrlen$ByteCharMultiWide
                                                                                                                                                                                        • String ID: 18$REG_DWORD
                                                                                                                                                                                        • API String ID: 477651035-3748107123
                                                                                                                                                                                        • Opcode ID: 22911195e3a13aa2991ff51c6204e7e352f94932cdca006830754f15c4e35233
                                                                                                                                                                                        • Instruction ID: 10bfe06c9ceeecc4f15360566cd13ea8488ae7e97c63037eb01ad52bf46f24d1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 22911195e3a13aa2991ff51c6204e7e352f94932cdca006830754f15c4e35233
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FD19F75D0424AABFB10CF64C8847EE77F5EF403D4F618169E8159B298EB70AE82CB51
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C7860 Relevance: 7.6, APIs: 5, Instructions: 150COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetStartupInfoA.KERNEL32(?), ref: 021C78BE
                                                                                                                                                                                        • GetFileType.KERNEL32(00000480), ref: 021C7969
                                                                                                                                                                                        • GetStdHandle.KERNEL32(-000000F6), ref: 021C79CC
                                                                                                                                                                                        • GetFileType.KERNEL32(00000000), ref: 021C79DA
                                                                                                                                                                                        • SetHandleCount.KERNEL32 ref: 021C7A11
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileHandleType$CountInfoStartup
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1710529072-0
                                                                                                                                                                                        • Opcode ID: ab3ba10f79a75568fb2e9acbc389102ec57dbeb94ef90e5daf0ed7c27228ba4b
                                                                                                                                                                                        • Instruction ID: 9d913e9b8b5514a106d996e15a2b514342dcb33770f30d3b654782d9dd5de3ab
                                                                                                                                                                                        • Opcode Fuzzy Hash: ab3ba10f79a75568fb2e9acbc389102ec57dbeb94ef90e5daf0ed7c27228ba4b
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE5128399852018FC725CF38D8C4766BBE9AB29338F354A6CC6A6C72D1D7B09846CF51
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDlgItem.USER32(?), ref: 00401CC5
                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401CD2
                                                                                                                                                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D10
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                        • Opcode ID: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                        • Instruction ID: 73f510c38aede9d1999832a0848f44238895318cfbb720f21bd33ecac166bac3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 22ec528c33522aeb45a0f33787abd60169ee1d64ba109e77d7fe73e3ddaa5202
                                                                                                                                                                                        • Instruction Fuzzy Hash: 57F0F9B2A04105BFD700EBA4EE89DAFB7BDEB44341B104476F601F21A0C7789D018B29
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C7601 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetLastError.KERNEL32(00000002,00000001,021C9CCA,021C849F,?,021CA0D8,?,00000001,00000002,00000002,?,00000000,00000007,?,021C8B99,00000001), ref: 021C7603
                                                                                                                                                                                        • TlsGetValue.KERNEL32(?,021C8B99,00000001,?,00000008,?,021C53CA,00000001,00000001,021C4DE3,00000000,00000042,00000000,?,00000001,00000000), ref: 021C7611
                                                                                                                                                                                        • SetLastError.KERNEL32(00000000,?,021C8B99,00000001,?,00000008,?,021C53CA,00000001,00000001,021C4DE3,00000000,00000042,00000000,?,00000001), ref: 021C765D
                                                                                                                                                                                          • Part of subcall function 021C9681: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00000000,00000042,00000000,?,00000001,00000000), ref: 021C9777
                                                                                                                                                                                        • TlsSetValue.KERNEL32(00000000,?,021C8B99,00000001,?,00000008,?,021C53CA,00000001,00000001,021C4DE3,00000000,00000042,00000000,?,00000001), ref: 021C7635
                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 021C7646
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2020098873-0
                                                                                                                                                                                        • Opcode ID: 46eeb5fee383ad6f1bcd36d84950438acc1008a4f2d56305d0fc26f698e97fa7
                                                                                                                                                                                        • Instruction ID: 00a44fa2ff309a01ff681f295b3acd7a4a928a84b2b61ff5163e34b2ead9579a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 46eeb5fee383ad6f1bcd36d84950438acc1008a4f2d56305d0fc26f698e97fa7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 43F02B3DEC12225BE7213B78B80861B7FE8AF217717310A6DF651D62C0DB6484A29ED0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004055CA Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CharNextA.USER32(|S@,?,C:\,00000000,0040562E,C:\,C:\,?,?,75922EE0,0040537C,?,"C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe" /S /Pzhuomian,75922EE0), ref: 004055D8
                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055DD
                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 004055EC
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                        • String ID: C:\$|S@
                                                                                                                                                                                        • API String ID: 3213498283-628904129
                                                                                                                                                                                        • Opcode ID: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                        • Instruction ID: 59c8476761b09c245942ad27e65994d154511812b78a9f1548afb2a8e03f2f93
                                                                                                                                                                                        • Opcode Fuzzy Hash: 28ecaceb9e9ffd293fb97d6fe9204fba0278c1012160d9bc2691c12c1e9fd827
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6F02751904E2166E73262644C04B3B979CDB95310F080837E201B71D1C2B84C82DFAE
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C5502 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(00000000,?,?,021C75D5,021C44EC,021C4545,?,?,?), ref: 021C5536
                                                                                                                                                                                          • Part of subcall function 021C3DBE: HeapFree.KERNEL32(00000000,?,00000000,00000010,021D2E77,?,021C3F7E,00000009,?,?,021D2E77), ref: 021C3E92
                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,021C75D5,021C44EC,021C4545,?,?,?), ref: 021C5551
                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32 ref: 021C5559
                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32 ref: 021C5561
                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32 ref: 021C5569
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalDeleteSection$FreeHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 447823528-0
                                                                                                                                                                                        • Opcode ID: d57f7e0795dcca2fb5dc60c1569208bd95763a8858bab3fbcc4a790a1eaef580
                                                                                                                                                                                        • Instruction ID: 85af225c5931488bd68dda70b4ce72e2b310fba2b44b80430dd04e38f9b4e896
                                                                                                                                                                                        • Opcode Fuzzy Hash: d57f7e0795dcca2fb5dc60c1569208bd95763a8858bab3fbcc4a790a1eaef580
                                                                                                                                                                                        • Instruction Fuzzy Hash: F3F082BEDC0050BAC9343A2FAD48C5B7E53ABF02543B6243FE854B7970871D6CA2C952
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10003C26 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 438registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Close
                                                                                                                                                                                        • String ID: %s%s%s$BANNER$REG_KEY
                                                                                                                                                                                        • API String ID: 3535843008-2613144944
                                                                                                                                                                                        • Opcode ID: 73a4a47dd520e4b43c12f764551808ab1abbe95dd6f6d599f4ecbe5c65a8ad96
                                                                                                                                                                                        • Instruction ID: 24f839f01534b3f9f3d948b0dba4e4d48467bf0e0abb3077ec95ed3de4646347
                                                                                                                                                                                        • Opcode Fuzzy Hash: 73a4a47dd520e4b43c12f764551808ab1abbe95dd6f6d599f4ecbe5c65a8ad96
                                                                                                                                                                                        • Instruction Fuzzy Hash: 37F1CAB2D00616EFFB11CB64CCC5AEF73E8EB043D4B128529F949A715AC734AD858B64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100046FC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 149registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 1000488F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 3735805505-2398078204
                                                                                                                                                                                        • Opcode ID: 596368eef4a0c09929316cdbfb4e5ab842f2647ea94dda1d72f982f5979cc6ca
                                                                                                                                                                                        • Instruction ID: 243c4d7ec57fe918d6d0940c97adc4b549421a4db24c1b758ac28f055b654191
                                                                                                                                                                                        • Opcode Fuzzy Hash: 596368eef4a0c09929316cdbfb4e5ab842f2647ea94dda1d72f982f5979cc6ca
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C41CDB1D00285BAFB11DB90CC81FAE77ADEB053C0F618865F604E2159EF74AE548799
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 1000544E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002E37: RegEnumValueA.ADVAPI32(00000930,?,?,?,000006E8,?,00000000,00000930,?,00000000), ref: 10002E7C
                                                                                                                                                                                          • Part of subcall function 10002E37: RegEnumValueA.ADVAPI32(00000930,00000007,?,?,000006E8,?,?,10003FFD,?,?,?,?), ref: 10002EE1
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 10005585
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 1000558A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseEnumValue
                                                                                                                                                                                        • String ID: Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 858281747-3591731957
                                                                                                                                                                                        • Opcode ID: fe8dc8850457a0ae8bfcf4f7bf873a395ca8a7ee23500ccc026f58682d979b55
                                                                                                                                                                                        • Instruction ID: 523df42ff7ef02b66a7152bd520a16a74cdafb2b48f53f26892e5cdfd4f1cf67
                                                                                                                                                                                        • Opcode Fuzzy Hash: fe8dc8850457a0ae8bfcf4f7bf873a395ca8a7ee23500ccc026f58682d979b55
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3641E2B6C0011DBFEF12CAC5CC85DEFBFBDEB09295F104466B904A2124E2369E55DBA1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100045A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,00000000,00010000,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00000000,?,\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp,00010000), ref: 100034B7
                                                                                                                                                                                          • Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 1000464C
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper$\??\C:\Users\user\AppData\Local\Temp\{B170E3C0-9961-47b4-9C8F-0491D4147672}.tmp
                                                                                                                                                                                        • API String ID: 3735805505-2398078204
                                                                                                                                                                                        • Opcode ID: 762580cbeacb7d90e5c7e35d10564c529704a20a3dd38c5c79dbb060ab3f82eb
                                                                                                                                                                                        • Instruction ID: 2050825871a45bdd784fa5f2d59d59491f3635497cfe19468187b331df60d10b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 762580cbeacb7d90e5c7e35d10564c529704a20a3dd38c5c79dbb060ab3f82eb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D41C2B1D00209ABFF15CB94CC85BAF77BDEF023D0F210029F601A6159EB7559508B96
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100031B1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SearchPathA.KERNEL32(00000000,00000000,00000000,00000104,?,00010000,?,00000000,REG_DWORD), ref: 10003202
                                                                                                                                                                                          • Part of subcall function 1000237C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000000,?,10003224,?,000000FF,00000000,?,IsUserActive,?,00000000), ref: 10002396
                                                                                                                                                                                        • SearchPathW.KERNEL32(?,00010000,00000000,?,00000000,10003818), ref: 10003281
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: PathSearch$ByteCharMultiWide
                                                                                                                                                                                        • String ID: IsUserActive$REG_DWORD
                                                                                                                                                                                        • API String ID: 920241381-872863536
                                                                                                                                                                                        • Opcode ID: 27675c240e6f9564e6327c227cd004533aa0a95c8e4853104729319132863ccc
                                                                                                                                                                                        • Instruction ID: 8fc82849368d7217e6239efb2a1568746849bcd7c8bfee583c703a93086b1f46
                                                                                                                                                                                        • Opcode Fuzzy Hash: 27675c240e6f9564e6327c227cd004533aa0a95c8e4853104729319132863ccc
                                                                                                                                                                                        • Instruction Fuzzy Hash: DA21627690011ABBEF02DFA4CC469DF7BB9FF082D0F004564FD11A6158E775DA509B90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004045CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00420500,00420500,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004044EE,000000DF,?,00000000,00000400), ref: 0040465C
                                                                                                                                                                                        • wsprintfA.USER32 ref: 00404664
                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00420500), ref: 00404677
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                        • Opcode ID: 2ec428eac170261c187a92505bdc363d28694616c8309a57a51f10684eba3706
                                                                                                                                                                                        • Instruction ID: 9ef1d31d43ed7f04e774dbb7b0bf9bfadd02bf4a4dcb113ad37d7c9c7133e094
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ec428eac170261c187a92505bdc363d28694616c8309a57a51f10684eba3706
                                                                                                                                                                                        • Instruction Fuzzy Hash: 23110473B001243BDB10A66D9C46EEF329EDBC6334F14023BF625F61D1E9789D1186A9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                        • Opcode ID: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                        • Instruction ID: d7011ec21094a782dcbe7947fab20a41340e67ab4a77a50b5f790120b2995d27
                                                                                                                                                                                        • Opcode Fuzzy Hash: fe5203184e7e09b5d9f4bb1be284e5a36febf03da949a6ba4cba52da4e1025f2
                                                                                                                                                                                        • Instruction Fuzzy Hash: B52183B1A44104BEDF01AFB5CE5BAAD7A75EF41704F14047EF501B61D1D6B88940D728
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00404D31 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00404D67
                                                                                                                                                                                        • CallWindowProcA.USER32(?,00000200,?,?), ref: 00404DD5
                                                                                                                                                                                          • Part of subcall function 00403E83: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 00403E95
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                        • String ID: $59cd53708ed730f0ef42bb01f668d936
                                                                                                                                                                                        • API String ID: 3748168415-793434733
                                                                                                                                                                                        • Opcode ID: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                        • Instruction ID: ca4354f5c4b8917eef9c40a956cdd667d29c971957ea1c54f02525437b92d001
                                                                                                                                                                                        • Opcode Fuzzy Hash: 92273547af9c30bc8dde7706ca5d0633a8d6b50f77785a764342fef82ee55045
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B116D71600219BBDF21AF51EC80A9B3A69AF84365F40813BFB08651A1C7789D918FA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10002C7B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000808,REG_DWORD,10027780,10003020,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?), ref: 10002C96
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000408,REG_DWORD,10027780,10003020,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?), ref: 10002CBC
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000004,00000400,00000000,00000000), ref: 10002CD7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocGlobal$ByteCharMultiWide
                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                        • API String ID: 2030156529-3740793138
                                                                                                                                                                                        • Opcode ID: fc64ed17b903e3899c077776821cbd57459736d6cb3056fc7c67814bddabf1b4
                                                                                                                                                                                        • Instruction ID: f3ab0f1b1d71ccfb36cfdf9fed2a1d9ca7cd58b359c6c0ec9dd6f3fbbbb2432f
                                                                                                                                                                                        • Opcode Fuzzy Hash: fc64ed17b903e3899c077776821cbd57459736d6cb3056fc7c67814bddabf1b4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7AF0C272940320EFF3918F54CC85E5B37F4F789BE1F100229F789A62A8DA355440CB61
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10003656 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegDeleteValueA.ADVAPI32(?,00000000,IsUserActive,Software\360WallPaper,100049B0,00000000,IsUserActive), ref: 10003673
                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                        • RegDeleteValueW.ADVAPI32(00000000,00000000,100049B0,00000000,IsUserActive), ref: 10003693
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DeleteValue$FreeGlobal
                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper
                                                                                                                                                                                        • API String ID: 2301017085-3623357663
                                                                                                                                                                                        • Opcode ID: 8887cd0fd139457d5349fb5184f25190e08ef9d00bff1fb146f170bdef2a4d25
                                                                                                                                                                                        • Instruction ID: 2cb8b26031d74d85c98f9d886234eeb30e9260fcc359113f1dbcccb504680b0d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8887cd0fd139457d5349fb5184f25190e08ef9d00bff1fb146f170bdef2a4d25
                                                                                                                                                                                        • Instruction Fuzzy Hash: B3E092365152627BEE029B25EC0895B7FEEFFC92E2B114839F049C2128DB21CC418650
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004052A3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24processCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422508,Error launching installer), ref: 004052C8
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 004052D5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004052A3
                                                                                                                                                                                        • Error launching installer, xrefs: 004052B6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
                                                                                                                                                                                        • API String ID: 3712363035-7751565
                                                                                                                                                                                        • Opcode ID: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                        • Instruction ID: ecae64e874cd01a2b34c598d60022b54c52eec95b920328752207242d2311f01
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e9196d07cff5197ece28638b51250dff36f8ea3aafe8f1c9d3ab4da7d74b4ee
                                                                                                                                                                                        • Instruction Fuzzy Hash: 31E0ECB4A00209BBDB009F64ED09E6B7BBDEB04304F90C522A911E2190D778E9508A79
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00405536 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 0040553C
                                                                                                                                                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040320F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,0040336F), ref: 00405545
                                                                                                                                                                                        • lstrcatA.KERNEL32(?,0040900C), ref: 00405556
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405536
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 2659869361-823278215
                                                                                                                                                                                        • Opcode ID: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                        • Instruction ID: a8815a40c5cf52564b0ee38fd83154c3193b14c3492e6d39585f1257e3d031c0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 103a7f091eca4e356757d037532255daa0bd9c7b09fb9152348cdcff170487b5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 82D0A9A2605A30BEE20232198C09E8B2A09CF02310B054422F200B62D2C2BC8E018FFE
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C46F3 Relevance: 6.5, APIs: 5, Instructions: 278COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: c5d4092cf896cc91a269ae4f4a0e1fade61afd99260f712d9756b2638628265d
                                                                                                                                                                                        • Instruction ID: 91dd14b8f7591f14b22ab324f6433321c3c454759d73dfca081e43507c104ff2
                                                                                                                                                                                        • Opcode Fuzzy Hash: c5d4092cf896cc91a269ae4f4a0e1fade61afd99260f712d9756b2638628265d
                                                                                                                                                                                        • Instruction Fuzzy Hash: FE91F979D89164AEDF219FA8DC50ADEBBB9EB68760F30052DF815B7180D3318D50CB64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C6E3E Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,00002020,021CF578,021CF578,?,?,021C730A,?,00000010,021D2E77,00000009,00000009,?,021C3F91,00000010,?), ref: 021C6E5F
                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,021C730A,?,00000010,021D2E77,00000009,00000009,?,021C3F91,00000010,?), ref: 021C6E83
                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,021C730A,?,00000010,021D2E77,00000009,00000009,?,021C3F91,00000010,?), ref: 021C6E9D
                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,021C730A,?,00000010,021D2E77,00000009,00000009,?,021C3F91,00000010,?), ref: 021C6F5E
                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,00000000,?,?,021C730A,?,00000010,021D2E77,00000009,00000009,?,021C3F91,00000010,?,?,021D2E77), ref: 021C6F75
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocVirtual$FreeHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 714016831-0
                                                                                                                                                                                        • Opcode ID: f09a56b475f2dc554a348d3ff01cbd802fe6d73ea67c5ca6af839d33b16a0bf4
                                                                                                                                                                                        • Instruction ID: 2d48091189f1a3dea69bd491b3505f48bacf82d1e1154ab8eff19ae3b9def646
                                                                                                                                                                                        • Opcode Fuzzy Hash: f09a56b475f2dc554a348d3ff01cbd802fe6d73ea67c5ca6af839d33b16a0bf4
                                                                                                                                                                                        • Instruction Fuzzy Hash: B531B2B9DC07019BD3308F28EC44B22BBE9E794795F314A3FE26997680E774A491CB54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C84B2 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,00000002,00000001,00000001), ref: 021C8579
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                        • Opcode ID: 324031fff0527a76b9c45068334f9f7721650f157a08d1713701fa7728776bb5
                                                                                                                                                                                        • Instruction ID: 10b6a7a1f86565106f9082a89e89eb81c883e6f7a9a8fea8b0dc8aa542da9be8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 324031fff0527a76b9c45068334f9f7721650f157a08d1713701fa7728776bb5
                                                                                                                                                                                        • Instruction Fuzzy Hash: DF519D78940258EFCB12DF68C884AAE7BF2FF55340F2285A9E9159B250D770DA41CF64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C41B4 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(021D4E4C), ref: 021C41F8
                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(021D4E4C), ref: 021C4207
                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(021D4E4C), ref: 021C423A
                                                                                                                                                                                        • InterlockedDecrement.KERNEL32(021D4E4C), ref: 021C42D2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Interlocked$Decrement$Increment
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2574743344-0
                                                                                                                                                                                        • Opcode ID: 3c9444b5f133a96c685f2dc9cfaf7b2c3b13473bbbbd872c5514a00e78d49e1a
                                                                                                                                                                                        • Instruction ID: c5011e4ea3a17ef04de18f2449ea480fcfdd50527768f638626fbb37ee485654
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c9444b5f133a96c685f2dc9cfaf7b2c3b13473bbbbd872c5514a00e78d49e1a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6731233DA88254BFEB225AA0BC66BAB7FA6EB21720F30005DF550AA180C77459D1CB50
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C3450 Relevance: 6.1, APIs: 4, Instructions: 95stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 021C349D
                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 021C34C5
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00000104,?,00000002,00000000,00000000), ref: 021C34F7
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001,?,00000000,00000104,?,00000002,00000000,00000000), ref: 021C3523
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3109718747-0
                                                                                                                                                                                        • Opcode ID: ac93a7b4ceaf8657510664414e25872b2d598e608ccc0cbe0bda96bc318ddaec
                                                                                                                                                                                        • Instruction ID: 684e42844301903b8b38a3af493f83d79f0a087667f2ccc6fba889465406d450
                                                                                                                                                                                        • Opcode Fuzzy Hash: ac93a7b4ceaf8657510664414e25872b2d598e608ccc0cbe0bda96bc318ddaec
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36314D7A6442087BD724CA18DC42FEB7769EB54720F2045ACFA5597380DBB09E54CB90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
                                                                                                                                                                                        • GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
                                                                                                                                                                                        • VerQueryValueA.VERSION(?,0040900C,?,?,?,?,?,00000000), ref: 00401F24
                                                                                                                                                                                          • Part of subcall function 004059A1: wsprintfA.USER32 ref: 004059AE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1404258612-0
                                                                                                                                                                                        • Opcode ID: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                        • Instruction ID: 5d9bf0a38514312ff05957db8cc1166864d5adc8fb1377831f0fed305f4f1e15
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f72770c8bc9875f9e81eeb047f1ec39c93fbbcbf5e4135a1b5dfac57f25ef0d
                                                                                                                                                                                        • Instruction Fuzzy Hash: E81136B2900109BEDB01EFA5D981DAEBBB9AF04344B20803AF501F61E1D7388A55DB28
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10002C08 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 35memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000808,REG_DWORD,10002FDA,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?,?), ref: 10002C22
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000004,00000400), ref: 10002C3D
                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000408,REG_DWORD,10002FDA,REG_DWORD,10027780,00000000,REG_DWORD,00000400,00000001,10027780,00000400,?,?,?,?), ref: 10002C4C
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocGlobal$ByteCharMultiWide
                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                        • API String ID: 2030156529-3740793138
                                                                                                                                                                                        • Opcode ID: 9ba7816f0905f7030245ccdfafec85fe055ecf30b2794630c4898116e18c86e6
                                                                                                                                                                                        • Instruction ID: f6eb400b8e10d4381344538113f595ce5c5eebdd765b5859096f662afcad7d3e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ba7816f0905f7030245ccdfafec85fe055ecf30b2794630c4898116e18c86e6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2EF06275584320EFF391CB50CD85F4633E0F708B91F204214F799AA2E8DA7468448F55
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D22
                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000), ref: 00401D29
                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
                                                                                                                                                                                        • CreateFontIndirectA.GDI32(004093C8), ref: 00401D8A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirect
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3272661963-0
                                                                                                                                                                                        • Opcode ID: f2fc6ce3319c5e561789d0ff15f9acfce02f03e665ec53c0c1a814e211245043
                                                                                                                                                                                        • Instruction ID: 7786b31e84b17939d49dd2ad1307eeb8220d0898c8d3ce275e00d9fc0f48c68a
                                                                                                                                                                                        • Opcode Fuzzy Hash: f2fc6ce3319c5e561789d0ff15f9acfce02f03e665ec53c0c1a814e211245043
                                                                                                                                                                                        • Instruction Fuzzy Hash: E7F0C8B0959740AEE7005770AE6E7993F64A719705F245435F542FA1E3C1BC0800CF3E
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00402012 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134comCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402065
                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040A808,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040211F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Roaming\360wp\User Data, xrefs: 0040209D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Roaming\360wp\User Data
                                                                                                                                                                                        • API String ID: 123533781-1093102105
                                                                                                                                                                                        • Opcode ID: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                        • Instruction ID: 9b89665ae90dc8b4180d3c8d33d84192eed4ab63dd5a898af4d907ee2c273e32
                                                                                                                                                                                        • Opcode Fuzzy Hash: b07ea3b5f1d9382c009d5b10b0a54fff049050fdf16a6359b130d18bb98fe30b
                                                                                                                                                                                        • Instruction Fuzzy Hash: F0416FB5A00104AFDB00DFA4CD89E9E7BB9EF49314B20416AF905EB2D1CA79DD41CB64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C9A28 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Info
                                                                                                                                                                                        • String ID: $
                                                                                                                                                                                        • API String ID: 1807457897-3032137957
                                                                                                                                                                                        • Opcode ID: 98e91cdf6c35ee10a2c27806e139acbb389d31d3eb75d16c080fc882766cf7cc
                                                                                                                                                                                        • Instruction ID: d46b99a79b0602ff0f9a812349544dbf6f7b9397a5e6688e26acd94749b03fad
                                                                                                                                                                                        • Opcode Fuzzy Hash: 98e91cdf6c35ee10a2c27806e139acbb389d31d3eb75d16c080fc882766cf7cc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 77417634685298AED726C614CC5AFFB7FE9AB11704F3504E9D15ADB182C3264784CFB2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C30E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SHSetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,00000001,?,00000103), ref: 021C31C5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                        • API String ID: 3702945584-2395435937
                                                                                                                                                                                        • Opcode ID: 1623bea2cac85561c2e62e7464f234eccc171b08d1d30ee613cec313793e184d
                                                                                                                                                                                        • Instruction ID: e7e3a477b14b181c4d1bbad5781166c8efe34c5d2733040905f8ce5743778ade
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1623bea2cac85561c2e62e7464f234eccc171b08d1d30ee613cec313793e184d
                                                                                                                                                                                        • Instruction Fuzzy Hash: C021D1391482809EF3258628C808BF77BE5EBE1710F28C5ADE9E5C7381EF7059088762
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10003292 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82processCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateProcessA.KERNEL32(?,?,10027780,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,10027780), ref: 10003315
                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                        • CreateProcessW.KERNEL32(?,?,10027780,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,1000384D), ref: 1000336D
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateProcess$FreeGlobal
                                                                                                                                                                                        • String ID: REG_DWORD
                                                                                                                                                                                        • API String ID: 4023010479-3740793138
                                                                                                                                                                                        • Opcode ID: bf5e7a4f0ac82943dd2a548e61c3cf54314dd7c45850d882d51d0582140ecce1
                                                                                                                                                                                        • Instruction ID: 79578aae78e280bfbc3557a1042b5dc1f117bd97d0e02cdd4c4a421a6e62ab7f
                                                                                                                                                                                        • Opcode Fuzzy Hash: bf5e7a4f0ac82943dd2a548e61c3cf54314dd7c45850d882d51d0582140ecce1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B21B57690010EBBEF029FE0CD458DEBFB6FF0C294B054565FA15A2125DB36EA61AB40
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 00403897 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,00423700), ref: 0040392F
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                        • String ID: 2052$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                        • API String ID: 530164218-1217774910
                                                                                                                                                                                        • Opcode ID: 025396f58e7aa16d0618e008d42c19969a52e5f0be75b3478bf19f5a2c1eaf00
                                                                                                                                                                                        • Instruction ID: 2adf9cbe04a35390a97661ff7fb7b78584b9eec01914685aa61950304d63ee05
                                                                                                                                                                                        • Opcode Fuzzy Hash: 025396f58e7aa16d0618e008d42c19969a52e5f0be75b3478bf19f5a2c1eaf00
                                                                                                                                                                                        • Instruction Fuzzy Hash: A911CFB1F046119BC734AF15EC809377BBDEB88726369817BE901A73D1C63D9A029A58
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10004945 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 10002B98: GlobalFree.KERNEL32(00000400), ref: 10002BF8
                                                                                                                                                                                          • Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,10027780,00000400,10003008,10027780,00000400,?,?,?,?), ref: 10002BDA
                                                                                                                                                                                          • Part of subcall function 10003656: RegDeleteValueA.ADVAPI32(?,00000000,IsUserActive,Software\360WallPaper,100049B0,00000000,IsUserActive), ref: 10003673
                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 100049B7
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ByteCharCloseDeleteFreeGlobalMultiValueWide
                                                                                                                                                                                        • String ID: IsUserActive$Software\360WallPaper
                                                                                                                                                                                        • API String ID: 2348214401-3623357663
                                                                                                                                                                                        • Opcode ID: 32a5098b3b3792e2d1f6d350db3674fc5a49eab3fc1276cf718b585f818e8a30
                                                                                                                                                                                        • Instruction ID: 5fe10952a492746ac63a388213dd0f829e5abeace9a43b19803b691c94aaf9e3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 32a5098b3b3792e2d1f6d350db3674fc5a49eab3fc1276cf718b585f818e8a30
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F01D276800204BBFB11CB51CC0AF9F7BADDF417E0F200065FA04A215ADB75AE0196A4
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 10003100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileA.KERNEL32(00000000,00000002,00000000,00000000,40000000,?,10004D86,10027780,Software\360WallPaper,?,10004D86,IsUserActive,40000000,00000000,00000000,00000002), ref: 1000312D
                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000080,00000002,00000000,00000000,40000000,?,10004D86,?,10004D86,IsUserActive,40000000,00000000,00000000,00000002,00000080,00000000), ref: 1000315B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateFile$FreeGlobal
                                                                                                                                                                                        • String ID: Software\360WallPaper
                                                                                                                                                                                        • API String ID: 1218761222-3217021507
                                                                                                                                                                                        • Opcode ID: 3111603f14ea56399cb1f6a9fb0847b370255bdcd137278cc312b1045e311fa1
                                                                                                                                                                                        • Instruction ID: 74c5b6659c73766a368cdaed38220c824ad993bcbbf413254767937a812eba87
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3111603f14ea56399cb1f6a9fb0847b370255bdcd137278cc312b1045e311fa1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B01B23610015ABBEF029F94EC05CDB3FAAFF8C2A0B008425FA1891124D736D971AB90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C3310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: TrustVerify
                                                                                                                                                                                        • String ID: ,$O
                                                                                                                                                                                        • API String ID: 3336249576-3651001137
                                                                                                                                                                                        • Opcode ID: 5be109bc365e0ff410d08bd64d69ad3283d89c31e0595d1c0eb41d764635f81b
                                                                                                                                                                                        • Instruction ID: bc31df54c76b59c4f35dde0fcbb730e3c7fc1502af2c952e0840935ba37f5323
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5be109bc365e0ff410d08bd64d69ad3283d89c31e0595d1c0eb41d764635f81b
                                                                                                                                                                                        • Instruction Fuzzy Hash: A511AFB050C3828ED311CF28845464BBFE1AFE6704F048A6EF1D58A292D3B686498B97
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 004024B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000011), ref: 004024CE
                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024ED
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\System.dll, xrefs: 004024BC, 004024E1
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileWritelstrlen
                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsyACA0.tmp\System.dll
                                                                                                                                                                                        • API String ID: 427699356-1569166279
                                                                                                                                                                                        • Opcode ID: 4b9a8f95d8e6fe6c33bef471b69875b5f2e2fd1ae903229e5d04e5c59b4d2165
                                                                                                                                                                                        • Instruction ID: bca52da527a61a3068b9a7417769ad1d2fd465c434b27635418a89c8b40edd75
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b9a8f95d8e6fe6c33bef471b69875b5f2e2fd1ae903229e5d04e5c59b4d2165
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CF0E9B2A54240BFD700EBE19E49AAB3668DB41305F20843BB142F51C2D6BD89819B3D
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 1000316C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(00000000,IsUserActive,00000000,10003387,?,100037F9,IsUserActive,IsUserActive,00000400,?,?,?,?), ref: 10003185
                                                                                                                                                                                          • Part of subcall function 10002335: GlobalFree.KERNEL32(00000000), ref: 10002340
                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,10003387,?,100037F9,IsUserActive,IsUserActive,00000400,?,?,?,?), ref: 100031A1
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AttributesFile$FreeGlobal
                                                                                                                                                                                        • String ID: IsUserActive
                                                                                                                                                                                        • API String ID: 3116069549-960559786
                                                                                                                                                                                        • Opcode ID: b0040dd0d3c89e14ca5a3306b12d4be60eadcb490ea2262c82b620b1b288e48a
                                                                                                                                                                                        • Instruction ID: 305a3f1c30f4f05c2244c7c445180b7159b1366a742890e0fe54cc613a0ea0da
                                                                                                                                                                                        • Opcode Fuzzy Hash: b0040dd0d3c89e14ca5a3306b12d4be60eadcb490ea2262c82b620b1b288e48a
                                                                                                                                                                                        • Instruction Fuzzy Hash: F7E086366441217BFA029739ED4899F3BEAEFC93F27654639F018C20A8DB24CC418551
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040557D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 00405583
                                                                                                                                                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Program Files (x86)\360\360Desktop\modules,00402CC7,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,C:\Program Files (x86)\360\360Desktop\modules\360wpappInstaller_zhuomian.exe,80000000,00000003), ref: 00405591
                                                                                                                                                                                        Strings
                                                                                                                                                                                        • C:\Program Files (x86)\360\360Desktop\modules, xrefs: 0040557D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                        • String ID: C:\Program Files (x86)\360\360Desktop\modules
                                                                                                                                                                                        • API String ID: 2709904686-4274933745
                                                                                                                                                                                        • Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                        • Instruction ID: a78a31216ab9b60c328ce82f5fccc260d5afe3ad280ceae17d90b4b54361c34b
                                                                                                                                                                                        • Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
                                                                                                                                                                                        • Instruction Fuzzy Hash: 56D09E62509AA06EE30266549C04B9B6A49DB16710F195862E540A6195C2785D418EA9
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 100022B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,WideInitialize() required.,WideFunc.h header,00000010), ref: 100022D5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2511268344.0000000010001000.00000020.00000001.01000000.00000016.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511227609.0000000010000000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511303159.0000000010006000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511339419.0000000010007000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511387117.0000000010027000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511446633.0000000010047000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2511509173.0000000010058000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_10000000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                        • String ID: WideFunc.h header$WideInitialize() required.
                                                                                                                                                                                        • API String ID: 2030045667-1193123403
                                                                                                                                                                                        • Opcode ID: c06a0c939cd463eb93c852ebc662a5d4828bb1a1b56a4cc0927362c1b7063354
                                                                                                                                                                                        • Instruction ID: b7ecd952ef69b07184ea3c549d6369c39419215407db36073fbb9cb7351f4b52
                                                                                                                                                                                        • Opcode Fuzzy Hash: c06a0c939cd463eb93c852ebc662a5d4828bb1a1b56a4cc0927362c1b7063354
                                                                                                                                                                                        • Instruction Fuzzy Hash: 17C04C30DD1761EBFA21C7608D49B813252F7197F7F218744F369250EDC3B520549559
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C699C Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapReAlloc.KERNEL32(00000000,?,?,00000000,021C6764,?,?,021D2E77,021C3F33,?,?,?,021D2E77), ref: 021C69C4
                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,021C6764,?,?,021D2E77,021C3F33,?,?,?,021D2E77), ref: 021C69F8
                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,021D2E77), ref: 021C6A12
                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,?,?,021D2E77), ref: 021C6A29
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocHeap$FreeVirtual
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3499195154-0
                                                                                                                                                                                        • Opcode ID: 001f6e50b9db7223904ce92a88bc45ad187b860b203d2872510ef3828a47dd4a
                                                                                                                                                                                        • Instruction ID: b73227daaed45a0a42dd376d87e0b5a2fd18c6616b67fcbf7d38a96826b8d4e3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 001f6e50b9db7223904ce92a88bc45ad187b860b203d2872510ef3828a47dd4a
                                                                                                                                                                                        • Instruction Fuzzy Hash: BE113D35A82241EFC7219F28EC89A237BF6FB957257304E2DE156D7190D3B598A2CB00
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 0040568F Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405696
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004056AF
                                                                                                                                                                                        • CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004056BD
                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,0040589D,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004056C6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2507286870.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507244690.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507374655.0000000000407000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000409000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.000000000040B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000421000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000424000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000426000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507434478.0000000000429000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2507785215.0000000000430000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_400000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                        • Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                        • Instruction ID: f65b762de9c196bf4895d9b9c03b18621a66a0ffa1d04d6b890c27cf309056ad
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0EF0A736249D51DBC2025B655C04E7B7E94EF92354B640D7AF444F2240D33A98159FBF
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 021C54D9 Relevance: 5.0, APIs: 4, Instructions: 12COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(?,021C7582,?,021C4483), ref: 021C54E6
                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32 ref: 021C54EE
                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32 ref: 021C54F6
                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32 ref: 021C54FE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000F.00000002.2509480177.00000000021C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 021C0000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509418710.00000000021C0000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509523596.00000000021CD000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509599222.00000000021CF000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509639234.00000000021D1000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000F.00000002.2509701800.00000000021D5000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_15_2_21c0000_360wpappInstaller_zhuomian.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalInitializeSection
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 32694325-0
                                                                                                                                                                                        • Opcode ID: 858903337e24a617eb605d54c93fea823fb6d6f4fa9b8d7a9dae2699649162fd
                                                                                                                                                                                        • Instruction ID: 488f24fd601b1916e43678e791bbb287f75455e6c01f8b8d9c470a4344a2029a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 858903337e24a617eb605d54c93fea823fb6d6f4fa9b8d7a9dae2699649162fd
                                                                                                                                                                                        • Instruction Fuzzy Hash: 06C00279CA5034BECA512F66FC048473FA7FB442A03252963B10451834866D1CB2DFD1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 001DE6D0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 359stringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 669 1de6d0-1de74b call 1e1510 SHGetFolderPathW lstrcatW 672 1de750-1de759 669->672 672->672 673 1de75b-1de783 call 1d7aa0 672->673 676 1de78b-1de797 call 1e3668 673->676 677 1de785 673->677 680 1de79d-1de7a3 676->680 681 1deb91-1deb97 676->681 677->676 684 1de7a5-1de7ad 680->684 685 1de7b3 680->685 682 1deb99-1deba5 call 1e0f32 681->682 683 1deba8-1debc9 call 1e1970 681->683 682->683 687 1de7b9-1de7c6 lstrlenW 684->687 689 1de7af-1de7b1 684->689 685->687 691 1de7cc-1de7e2 call 1e3680 call 1d2960 687->691 692 1de7c8-1de7ca 687->692 694 1de7e4-1de824 call 1d4520 call 1d4590 call 1d4520 call 1e354b call 1d4330 689->694 691->694 692->694 709 1de82a-1de82f 694->709 710 1deb84-1deb8c call 1d4590 694->710 711 1de839 709->711 712 1de831-1de837 709->712 710->681 714 1de83c-1de846 711->714 712->714 716 1de848-1de85b call 1d4590 call 1d7530 714->716 717 1de860-1de87d call 1d4420 714->717 716->683 723 1de9e3-1dea02 call 1d4420 717->723 724 1de883-1de89b call 1d4420 717->724 723->710 731 1dea08-1dea20 call 1d4420 723->731 724->723 730 1de8a1-1de8ee 724->730 732 1de8f5-1de90c call 1d4420 730->732 731->710 737 1dea26 731->737 738 1de97f-1de985 732->738 739 1de90e-1de923 call 1d44a0 732->739 740 1dea32-1dea7d 737->740 738->732 741 1de98b-1de992 738->741 749 1de92e 739->749 750 1de925-1de92c 739->750 743 1dea84-1dea9b call 1d4420 740->743 744 1de9bb-1de9dd call 1d6e90 call 1db770 741->744 745 1de994-1de99b 741->745 755 1deb46-1deb4c 743->755 756 1deaa1-1deab6 call 1d44a0 743->756 744->723 744->730 745->744 748 1de99d-1de9a4 745->748 748->744 753 1de9a6-1de9ad 748->753 754 1de933-1de935 749->754 750->749 750->754 753->744 760 1de9af-1de9b8 call 1de610 753->760 761 1de938-1de93d 754->761 755->743 759 1deb52-1deb7e call 1de610 call 1d6e90 call 1db770 755->759 768 1deab8-1deabf 756->768 769 1deac1 756->769 759->710 787 1dea30 759->787 760->744 761->761 767 1de93f-1de941 761->767 767->738 772 1de943-1de96e call 1d4a80 call 1ddd40 767->772 768->769 773 1deac6-1deacb 768->773 769->773 772->738 785 1de970-1de97c call 1e0f32 772->785 776 1dead0-1dead5 773->776 776->776 780 1dead7-1dead9 776->780 780->755 783 1deadb-1deafa 780->783 786 1deb00-1deb05 783->786 785->738 786->786 789 1deb07-1deb35 call 1d5740 call 1ddd40 786->789 787->740 789->755 795 1deb37-1deb43 call 1e0f32 789->795 795->755
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DE6FD
                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001DE711
                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\360desktop\loopwallpaper.xml), ref: 001DE723
                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 001DE7BA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FolderPath_memsetlstrcatlstrlen
                                                                                                                                                                                        • String ID: \360desktop\loopwallpaper.xml$catelog_id$favorite$favorites$favorites_will_download$value
                                                                                                                                                                                        • API String ID: 3348383912-4284236780
                                                                                                                                                                                        • Opcode ID: 12cdbec33fe8743aecc7d46da32becf909f71ba06738e2cd20d97b8db532745e
                                                                                                                                                                                        • Instruction ID: 4ef2057341886054e7a064840a401d7c91e252ca25551ce22d6a6fcced4e5e78
                                                                                                                                                                                        • Opcode Fuzzy Hash: 12cdbec33fe8743aecc7d46da32becf909f71ba06738e2cd20d97b8db532745e
                                                                                                                                                                                        • Instruction Fuzzy Hash: E0E16D719002499BDF35EFA4DC95BEE73B4BF14305F44452AE90A9F391EB70AA48CB90
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001DF3B0 Relevance: 109.0, APIs: 41, Strings: 21, Instructions: 499windowCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 0 1df3b0-1df41b call 1e1510 StrStrIW 3 1df41d-1df425 0->3 4 1df427-1df431 StrStrIW 0->4 7 1df46e-1df4a1 SHGetValueW PathFileExistsW 3->7 5 1df43d-1df447 StrStrIW 4->5 6 1df433-1df43b 4->6 8 1df44e-1df458 StrStrIW 5->8 9 1df449 5->9 6->7 10 1df4c5 7->10 11 1df4a3-1df4b5 call 1d1000 7->11 8->7 12 1df45a-1df45c 8->12 9->8 14 1df4c9-1df4d3 StrStrIW 10->14 21 1df9e7-1df9e9 11->21 22 1df4bb-1df4c3 11->22 12->7 15 1df45e-1df468 StrStrIW 12->15 17 1df50c-1df54b SHSetValueW 14->17 18 1df4d5-1df4d9 14->18 15->7 15->21 19 1df635-1df669 SHGetValueW 17->19 20 1df551-1df575 SHSetValueW call 1dd9d0 17->20 18->17 23 1df4db-1df4f1 MessageBoxW 18->23 26 1df66f-1df6b7 SHSetValueW call 1de6d0 19->26 27 1df708-1df73c SHGetValueW 19->27 31 1df57a-1df57c 20->31 25 1dfa94-1dfaac call 1e1970 21->25 22->14 28 1df4f7-1df506 ShellExecuteW 23->28 29 1df7d0-1df876 call 1d6980 call 1d5a70 call 1d56d0 call 1ddd00 call 1dbe80 DeleteFileW call 1e1510 SHGetFolderPathW call 1d6980 call 1d5a70 23->29 43 1df6be-1df702 call 1e1510 SHGetFolderPathW lstrcatW DeleteFileW 26->43 44 1df6b9 call 1df190 26->44 34 1df73e call 1dd0b0 27->34 35 1df76b-1df779 StrStrIW 27->35 28->17 81 1df87c-1df880 29->81 82 1dfa3a 29->82 31->19 37 1df582-1df5a4 call 1e1510 31->37 47 1df743-1df745 34->47 41 1dfa8f 35->41 42 1df77f-1df783 35->42 56 1df5b0-1df5c6 37->56 41->25 42->29 48 1df785-1df7a9 call 1d7bc0 call 1d7b90 42->48 43->27 44->43 47->35 52 1df747-1df769 SHSetValueW 47->52 65 1df7af-1df7cb ShellExecuteW call 1d7530 48->65 66 1df7ab 48->66 52->35 56->56 60 1df5c8-1df5fb PathRemoveArgsW PathAppendW call 1d1000 56->60 60->19 70 1df5fd-1df604 60->70 65->29 66->65 73 1df607-1df610 70->73 73->73 75 1df612-1df633 SHSetValueW 73->75 75->19 81->82 83 1df886-1df88d 81->83 84 1dfa3e-1dfa4e 82->84 85 1df88f-1df89c call 1d54e0 83->85 86 1df8a0-1df8a9 PathFileExistsW 83->86 87 1dfa5a-1dfa6a 84->87 88 1dfa50-1dfa55 84->88 85->86 86->84 90 1df8af-1df8e6 SHGetValueW 86->90 91 1dfa6c-1dfa71 87->91 92 1dfa76-1dfa83 87->92 88->87 95 1df8e8-1df8ec 90->95 96 1df8f2-1df919 CoInitialize DefWindowProcW call 1d8ac0 90->96 91->92 92->41 93 1dfa85-1dfa8c 92->93 93->41 95->84 95->96 99 1df91f-1df9b4 GdiplusStartup SHSetValueW call 1db570 call 1db830 96->99 100 1dfa23-1dfa38 CoUninitialize GetCurrentProcess TerminateProcess 96->100 105 1df9ee-1dfa1e ShowWindow call 1d8a20 call 1dbe40 GdiplusShutdown call 1d8c10 99->105 106 1df9b6-1df9e2 call 1d4760 call 1d8c10 call 1d4a60 * 3 99->106 100->84 105->100 106->21
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DF3FD
                                                                                                                                                                                        • StrStrIW.KERNELBASE(?,/s StartFrom=360wpsrv), ref: 001DF417
                                                                                                                                                                                        • StrStrIW.SHLWAPI(?,StartFrom=360wpsrv), ref: 001DF42D
                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe,00000000,?,?,?), ref: 001DF48B
                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(?), ref: 001DF499
                                                                                                                                                                                        • StrStrIW.SHLWAPI(?,onlyimport), ref: 001DF4CF
                                                                                                                                                                                        • MessageBoxW.USER32(00000000,001F6674,001F6698,00000014), ref: 001DF4E8
                                                                                                                                                                                        • ShellExecuteW.SHELL32(00000000,open,http://bizhi.360.cn/,00000000,00000000,00000005), ref: 001DF506
                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordloopinfo,?,?,?), ref: 001DF53B
                                                                                                                                                                                        • SHSetValueW.SHLWAPI ref: 001DF573
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DF59A
                                                                                                                                                                                        • PathRemoveArgsW.SHLWAPI(?), ref: 001DF5D0
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Value$Path_memset$ArgsExecuteExistsFileMessageRemoveShell
                                                                                                                                                                                        • String ID: StartFrom=4$/s StartFrom=360wpsrv$360WallPaper$360wpsrv.exe$Main dialog creation failed!$SOFTWARE\360WallPaper$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360wpapp.exe$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$StartFrom=360wpsrv$\360desktop\loopwallpaper.xml$\360wp\User Data\First Run$dtdescription$http://bizhi.360.cn/$http://stat.apc.360.cn/stat.html?type=new&action=zidaiyingyong&from=7&fangshi=$onlyimport$open$recordlocalfav$recordloginid$recordloopinfo$wallpaper.swf$wallpaper_cm.swf
                                                                                                                                                                                        • API String ID: 3855544870-4270518405
                                                                                                                                                                                        • Opcode ID: d145cc8cd1a77fc23ec68f616980542db163b0e9d7f3b08c8db32c80b3d7faaa
                                                                                                                                                                                        • Instruction ID: 03e57cc88f7b05644d09d9e8d0818296f73ce4967179444be47f6351c7e47287
                                                                                                                                                                                        • Opcode Fuzzy Hash: d145cc8cd1a77fc23ec68f616980542db163b0e9d7f3b08c8db32c80b3d7faaa
                                                                                                                                                                                        • Instruction Fuzzy Hash: 39029071104345ABD320DF64DC85EABB7E8FFD4704F044A2EF28A962A1EB70D645CB62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001DF5A6 Relevance: 63.3, APIs: 22, Strings: 14, Instructions: 304filestringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 121 1df5a6-1df5ad 122 1df5b0-1df5c6 121->122 122->122 123 1df5c8-1df5fb PathRemoveArgsW PathAppendW call 1d1000 122->123 126 1df5fd-1df604 123->126 127 1df635-1df669 SHGetValueW 123->127 128 1df607-1df610 126->128 129 1df66f-1df6b7 SHSetValueW call 1de6d0 127->129 130 1df708-1df73c SHGetValueW 127->130 128->128 134 1df612-1df633 SHSetValueW 128->134 139 1df6be-1df702 call 1e1510 SHGetFolderPathW lstrcatW DeleteFileW 129->139 140 1df6b9 call 1df190 129->140 132 1df73e-1df745 call 1dd0b0 130->132 133 1df76b-1df779 StrStrIW 130->133 132->133 149 1df747-1df769 SHSetValueW 132->149 137 1dfa8f 133->137 138 1df77f-1df783 133->138 134->127 141 1dfa94-1dfaac call 1e1970 137->141 143 1df785-1df7a9 call 1d7bc0 call 1d7b90 138->143 144 1df7d0-1df876 call 1d6980 call 1d5a70 call 1d56d0 call 1ddd00 call 1dbe80 DeleteFileW call 1e1510 SHGetFolderPathW call 1d6980 call 1d5a70 138->144 139->130 140->139 159 1df7af-1df7cb ShellExecuteW call 1d7530 143->159 160 1df7ab 143->160 174 1df87c-1df880 144->174 175 1dfa3a 144->175 149->133 159->144 160->159 174->175 176 1df886-1df88d 174->176 177 1dfa3e-1dfa4e 175->177 178 1df88f-1df89c call 1d54e0 176->178 179 1df8a0-1df8a9 PathFileExistsW 176->179 180 1dfa5a-1dfa6a 177->180 181 1dfa50-1dfa55 177->181 178->179 179->177 183 1df8af-1df8e6 SHGetValueW 179->183 184 1dfa6c-1dfa71 180->184 185 1dfa76-1dfa83 180->185 181->180 188 1df8e8-1df8ec 183->188 189 1df8f2-1df919 CoInitialize DefWindowProcW call 1d8ac0 183->189 184->185 185->137 186 1dfa85-1dfa8c 185->186 186->137 188->177 188->189 192 1df91f-1df9b4 GdiplusStartup SHSetValueW call 1db570 call 1db830 189->192 193 1dfa23-1dfa38 CoUninitialize GetCurrentProcess TerminateProcess 189->193 198 1df9ee-1dfa1e ShowWindow call 1d8a20 call 1dbe40 GdiplusShutdown call 1d8c10 192->198 199 1df9b6-1df9e9 call 1d4760 call 1d8c10 call 1d4a60 * 3 192->199 193->177 198->193 199->141
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • PathRemoveArgsW.SHLWAPI(?), ref: 001DF5D0
                                                                                                                                                                                        • PathAppendW.SHLWAPI(?,360wpsrv.exe), ref: 001DF5E3
                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,360WallPaper,00000001,?), ref: 001DF633
                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordlocalfav,?,?,?), ref: 001DF65F
                                                                                                                                                                                        • SHSetValueW.SHLWAPI ref: 001DF691
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DF6CC
                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,00000004,?,00000004), ref: 001DF6E1
                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\360desktop\loopwallpaper.xml), ref: 001DF6F4
                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?), ref: 001DF702
                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,recordloginid,?,?,?), ref: 001DF732
                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001), ref: 001DF769
                                                                                                                                                                                        • StrStrIW.SHLWAPI(?,onlyimport), ref: 001DF771
                                                                                                                                                                                        • ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000005), ref: 001DF7C1
                                                                                                                                                                                        • DeleteFileW.KERNEL32(?), ref: 001DF81D
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DF831
                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001DF846
                                                                                                                                                                                        • PathFileExistsW.SHLWAPI(?,\360wp\User Data\First Run,0000001A,?), ref: 001DF8A1
                                                                                                                                                                                          • Part of subcall function 001DD0B0: _memset.LIBCMT ref: 001DD0F4
                                                                                                                                                                                          • Part of subcall function 001DD0B0: GetModuleFileNameW.KERNEL32(00000000,?,00000207), ref: 001DD107
                                                                                                                                                                                          • Part of subcall function 001DD0B0: PathRemoveFileSpecW.SHLWAPI(?), ref: 001DD112
                                                                                                                                                                                          • Part of subcall function 001DD0B0: PathAppendW.SHLWAPI(?,360Login.dll), ref: 001DD122
                                                                                                                                                                                        • SHGetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,dtdescription,?,?,?), ref: 001DF8DE
                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 001DF8F3
                                                                                                                                                                                        • DefWindowProcW.USER32(00000000,00000000,00000000,00000000), ref: 001DF8FD
                                                                                                                                                                                        • GdiplusStartup.GDIPLUS ref: 001DF94C
                                                                                                                                                                                        • SHSetValueW.SHLWAPI(80000001,SOFTWARE\360WallPaper,dtdescription,00000004,?,00000004), ref: 001DF971
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: PathValue$File$_memset$AppendDeleteFolderRemove$ArgsExecuteExistsGdiplusInitializeModuleNameProcShellSpecStartupWindowlstrcat
                                                                                                                                                                                        • String ID: StartFrom=4$360WallPaper$360wpsrv.exe$Main dialog creation failed!$SOFTWARE\360WallPaper$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\360desktop\loopwallpaper.xml$\360wp\User Data\First Run$dtdescription$http://stat.apc.360.cn/stat.html?type=new&action=zidaiyingyong&from=7&fangshi=$onlyimport$open$recordlocalfav$recordloginid
                                                                                                                                                                                        • API String ID: 2306431065-3313355496
                                                                                                                                                                                        • Opcode ID: 9c187e12b779ec40f5ad1f270bfb1cf8e66953c3c50f0226e39f83731ba3f6aa
                                                                                                                                                                                        • Instruction ID: 05b52be08e3089be63350f82566d9bb0b9e5ed7c6bcadc3111367a7695cd9d40
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c187e12b779ec40f5ad1f270bfb1cf8e66953c3c50f0226e39f83731ba3f6aa
                                                                                                                                                                                        • Instruction Fuzzy Hash: 83B18071104345ABC324EF54DC85EABB7F8FFE4704F44492EF28A92261EBB09645CB62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C3D6890 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 162synchronizationmemoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(129EC632,?,?,?,?,?,?,?,?,?,?,6C3E744B,000000FF), ref: 6C3D68D7
                                                                                                                                                                                        • __snwprintf.LIBCMT ref: 6C3D68F1
                                                                                                                                                                                        • CreateMutexW.KERNELBASE(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3E744B), ref: 6C3D690B
                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3E744B,000000FF), ref: 6C3D691E
                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3E744B), ref: 6C3D692E
                                                                                                                                                                                        • GetEnvironmentVariableW.KERNEL32(1830B7BD-F7A3-4c4d-989B-C004DE465EDE,?,0000001F), ref: 6C3D6949
                                                                                                                                                                                        • _swscanf.LIBCMT ref: 6C3D6971
                                                                                                                                                                                        • ReleaseMutex.KERNEL32(00000000), ref: 6C3D6994
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 6C3D699F
                                                                                                                                                                                        • GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3E744B,000000FF), ref: 6C3D69CE
                                                                                                                                                                                        • HeapAlloc.KERNEL32(00000000,00000000,000005C0), ref: 6C3D69DF
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C3D6A18
                                                                                                                                                                                        • __swprintf.LIBCMT ref: 6C3D6A33
                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(1830B7BD-F7A3-4c4d-989B-C004DE465EDE,?), ref: 6C3D6A47
                                                                                                                                                                                        • __CxxThrowException@8.LIBCMT ref: 6C3D6A65
                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(1830B7BD-F7A3-4c4d-989B-C004DE465EDE,00000000,?,6C404C40), ref: 6C3D6A71
                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 6C3D6A7B
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C3D6A9A
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: EnvironmentMutexVariable$CloseException@8HandleHeapProcessReleaseThrow$AllocCreateCurrentErrorLastObjectSingleWait__snwprintf__swprintf_swscanf
                                                                                                                                                                                        • String ID: %s %u$%x:%x$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
                                                                                                                                                                                        • API String ID: 2628509032-3989918790
                                                                                                                                                                                        • Opcode ID: 1fa7d2a2b669d9846d1786f385158b5b40be4b25ee1a31a4dfda2ae950e2c7b0
                                                                                                                                                                                        • Instruction ID: 14bed85263240adffa197b4a89bcaf2bad0c256fe90652a5c646d1020ce9c864
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1fa7d2a2b669d9846d1786f385158b5b40be4b25ee1a31a4dfda2ae950e2c7b0
                                                                                                                                                                                        • Instruction Fuzzy Hash: CA51E2B2A00245EFDB14CF94CD48FEE7BB8FB49700F014919E925E7640DB35A5098F62
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001D1080 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 214filememoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 439 1d1080-1d10de CreateFileW 440 1d11dc 439->440 441 1d10e4-1d10fb ReadFile 439->441 442 1d11de-1d11f9 call 1e1970 440->442 443 1d11d5-1d11d6 CloseHandle 441->443 444 1d1101-1d1105 441->444 443->440 444->443 446 1d110b-1d1114 444->446 446->443 448 1d111a-1d112c SetFilePointer 446->448 448->443 449 1d1132-1d1149 ReadFile 448->449 449->443 450 1d114f-1d1156 449->450 450->443 451 1d1158-1d1162 450->451 451->443 452 1d1164-1d116c 451->452 452->443 453 1d116e-1d1182 452->453 453->443 454 1d1184-1d11a7 GetFileSize VirtualAlloc 453->454 454->443 455 1d11a9-1d11c6 SetFilePointer ReadFile 454->455 456 1d11c8-1d11cf VirtualFree 455->456 457 1d11fa-1d122b FindCloseChangeNotification call 1d1010 455->457 456->443 460 1d122e-1d123c 457->460 461 1d1316-1d1344 460->461 462 1d1242-1d1248 460->462 466 1d1354-1d1357 461->466 467 1d1346-1d134e VirtualFree 461->467 464 1d124e-1d1252 462->464 465 1d1327-1d132a 462->465 464->465 468 1d1258-1d1270 464->468 465->460 466->442 467->466 469 1d1276-1d1284 468->469 469->461 470 1d128a-1d1292 469->470 471 1d131f-1d1322 470->471 472 1d1298-1d129d 470->472 471->469 473 1d129f-1d12a7 472->473 474 1d12aa-1d1313 call 1d1010 * 2 call 1d1360 472->474 473->474 474->461
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,AF2CD25C), ref: 001D10D3
                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,?,00000040,?,00000000), ref: 001D10F7
                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,?,00000000,00000000), ref: 001D1123
                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,00000000,000000F8,00000040,00000000), ref: 001D1145
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 001D1187
                                                                                                                                                                                        • VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 001D119A
                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000), ref: 001D11B0
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,000000F8,000000F8,00000000), ref: 001D11C2
                                                                                                                                                                                        • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 001D11CF
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 001D11D6
                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(00000000), ref: 001D11FB
                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 001D134E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$ReadVirtual$CloseFreePointer$AllocChangeCreateFindHandleNotificationSize
                                                                                                                                                                                        • String ID: @$PE
                                                                                                                                                                                        • API String ID: 1173161148-957972822
                                                                                                                                                                                        • Opcode ID: 1aa3e2377af0fa6864f639879b76d599a720e6fc48071f06ccc661c4917d8ef6
                                                                                                                                                                                        • Instruction ID: 2ff33c9b686f3183e7a8bf5cc2bf2e2e6f534c27b8b354ae5ca61990b0f49e62
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1aa3e2377af0fa6864f639879b76d599a720e6fc48071f06ccc661c4917d8ef6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 63815E71E00718BBDB24DF69CC45BAEB7B4FF45710F10416AEA19AB681EB705980CB64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001D6DD0 Relevance: 15.1, APIs: 10, Instructions: 90COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 823 1d6dd0-1d6de2 824 1d6dee-1d6df3 823->824 825 1d6de4-1d6de9 DeleteObject 823->825 827 1d6dff-1d6e04 824->827 828 1d6df5-1d6dfa DeleteObject 824->828 825->824 826 1d6deb 825->826 826->824 830 1d6e06-1d6e0b DeleteObject 827->830 831 1d6e10-1d6e15 827->831 828->827 829 1d6dfc 828->829 829->827 830->831 832 1d6e0d 830->832 833 1d6e17-1d6e1c DeleteObject 831->833 834 1d6e21-1d6e26 831->834 832->831 833->834 835 1d6e1e 833->835 836 1d6e28-1d6e2d DeleteObject 834->836 837 1d6e32-1d6e37 834->837 835->834 836->837 838 1d6e2f 836->838 839 1d6e39-1d6e3e DeleteObject 837->839 840 1d6e43-1d6e48 837->840 838->837 839->840 843 1d6e40 839->843 841 1d6e4a-1d6e4f DeleteObject 840->841 842 1d6e54-1d6e59 840->842 841->842 844 1d6e51 841->844 845 1d6e5b-1d6e60 DeleteObject 842->845 846 1d6e65-1d6e6a 842->846 843->840 844->842 845->846 847 1d6e62 845->847 848 1d6e6c-1d6e71 DeleteObject 846->848 849 1d6e76-1d6e7a 846->849 847->846 848->849 850 1d6e73 848->850 851 1d6e7c-1d6e81 DeleteObject 849->851 852 1d6e85-1d6e88 849->852 850->849 851->852 853 1d6e83 851->853 853->852
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DeleteObject
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1531683806-0
                                                                                                                                                                                        • Opcode ID: fa290d2cca77e88d978401eb1e7b5d249c87f16be99049cbfae4e4be9f3f30ea
                                                                                                                                                                                        • Instruction ID: d5a667250a0518d4fa6ac85bfffbb56c4af519738c4d8676ba6e5e620bbded5b
                                                                                                                                                                                        • Opcode Fuzzy Hash: fa290d2cca77e88d978401eb1e7b5d249c87f16be99049cbfae4e4be9f3f30ea
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F21D574A00F028B9A30CFAEDC80917F3EEAF947403284E1BE485C3754EB74EC408A64
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C358AA0 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 386synchronizationCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 854 6c358aa0-6c358b4b call 6c347a80 call 6c357210 WaitForSingleObject call 6c384a30 ReleaseMutex 861 6c358b54-6c358b64 854->861 862 6c358b4d-6c358b4e FindCloseChangeNotification 854->862 863 6c358b66-6c358b68 861->863 864 6c358b9e-6c358ba1 861->864 862->861 867 6c358b73-6c358b99 call 6c3b8655 863->867 868 6c358b6a-6c358b70 call 6c3b8655 863->868 865 6c358bd6-6c358be2 864->865 866 6c358ba3-6c358ba5 864->866 872 6c358bf5-6c358bf7 865->872 873 6c358be4-6c358bef call 6c3b8e84 865->873 870 6c358ba7-6c358bad call 6c3b8655 866->870 871 6c358bb0-6c358bd1 call 6c3b8655 866->871 883 6c358ff8-6c359013 call 6c3b8660 867->883 868->867 870->871 891 6c358ff6 871->891 875 6c358c00-6c358c04 872->875 873->872 881 6c358f90-6c358f94 875->881 882 6c358c0a-6c358c16 875->882 889 6c358f96-6c358f9c call 6c3b8655 881->889 890 6c358f9f-6c358fc0 call 6c3b8655 881->890 882->875 887 6c358c18-6c358c1c 882->887 887->881 892 6c358c22-6c358c28 887->892 889->890 890->891 901 6c358feb-6c358ff1 call 6c347ae0 890->901 891->883 892->881 896 6c358c2e-6c358c32 892->896 899 6c358c45-6c358c49 896->899 900 6c358c34-6c358c3f call 6c3b8e84 896->900 903 6c358c80-6c358c84 899->903 904 6c358c4b-6c358c4f 899->904 900->899 901->891 906 6c358c97-6c358cb3 903->906 907 6c358c86-6c358c91 call 6c3b8e84 903->907 909 6c358c51-6c358c57 call 6c3b8655 904->909 910 6c358c5a-6c358c7b call 6c3b8655 904->910 912 6c358cb5-6c358cc0 call 6c3b8e84 906->912 913 6c358cc6-6c358cde 906->913 907->906 909->910 910->891 912->913 918 6c358ce0-6c358ce5 call 6c3b8e84 913->918 919 6c358ceb-6c358cfc call 6c393360 913->919 918->919 927 6c358d75-6c358d95 919->927 928 6c358cfe-6c358d3f call 6c3bc210 * 2 call 6c391ba0 919->928 930 6c358d97 927->930 931 6c358d9a-6c358dae call 6c3847a0 927->931 945 6c358d46-6c358d66 call 6c3920c0 928->945 946 6c358d41 call 6c3b8e84 928->946 930->931 937 6c358db1-6c358db5 931->937 939 6c358e6b-6c358e6e 937->939 940 6c358dbb-6c358dc7 937->940 943 6c358e70-6c358e79 call 6c3b8655 939->943 944 6c358e7c-6c358e8c 939->944 940->937 942 6c358dc9-6c358df7 call 6c3aca10 call 6c34a020 940->942 961 6c358dff-6c358e21 call 6c3acb10 942->961 962 6c358df9 942->962 943->944 949 6c358e94-6c358eaa call 6c3b1210 call 6c3b0830 944->949 945->927 959 6c358d68-6c358d70 call 6c34a760 945->959 946->945 967 6c358eac-6c358eb6 949->967 968 6c358f2a-6c358f38 call 6c344f10 949->968 959->901 961->949 973 6c358e23-6c358e31 call 6c344f10 961->973 962->961 970 6c358ee0 967->970 971 6c358eb8-6c358ede call 6c3b2500 967->971 980 6c358f46-6c358f5d 968->980 981 6c358f3a-6c358f43 call 6c3b8655 968->981 976 6c358ee2-6c358ef0 call 6c344f10 970->976 971->976 983 6c358e33-6c358e3c call 6c3b8655 973->983 984 6c358e3f-6c358e54 973->984 994 6c358ef2-6c358efb call 6c3b8655 976->994 995 6c358efe-6c358f13 976->995 987 6c358f5f-6c358f65 call 6c3b8655 980->987 988 6c358f68-6c358f8e call 6c3b8655 980->988 981->980 983->984 991 6c358e56-6c358e5c call 6c3b8655 984->991 992 6c358e5f-6c358e65 984->992 987->988 988->883 991->992 992->939 994->995 997 6c358f15-6c358f1b call 6c3b8655 995->997 998 6c358f1e-6c358f24 995->998 997->998 998->968
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 6C357210: CreateMutexW.KERNELBASE(00000000,00000000,?,129EC632,?,00000000,6C3E7BC8,000000FF,6C371EE3), ref: 6C35724C
                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,?,Local\360_login_account_config_lock2,?,129EC632,?,?,00000000), ref: 6C358B0F
                                                                                                                                                                                          • Part of subcall function 6C384A30: CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000000,00000000,?,?,?,?,?,?,6C358B2A), ref: 6C384A4B
                                                                                                                                                                                          • Part of subcall function 6C384A30: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,6C358B2A), ref: 6C384A5E
                                                                                                                                                                                          • Part of subcall function 6C384A30: CloseHandle.KERNEL32(00000000,?,?,?,?,6C358B2A), ref: 6C384A6D
                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 6C358B38
                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?), ref: 6C358B4E
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseCreateFileMutex$ChangeFindHandleNotificationObjectReleaseSingleSizeWait
                                                                                                                                                                                        • String ID: 360LOGINDATA$Local\360_login_account_config_lock2$ver
                                                                                                                                                                                        • API String ID: 3647123575-2962277479
                                                                                                                                                                                        • Opcode ID: 2cb4d35f00b01804c41d89957554b7d7bd88a7aa98520084840b7f50d10eddd3
                                                                                                                                                                                        • Instruction ID: 3738e648d0205d2408e310cc95b09ea5089cd171dbe1fe6a4f3f1440907feedc
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2cb4d35f00b01804c41d89957554b7d7bd88a7aa98520084840b7f50d10eddd3
                                                                                                                                                                                        • Instruction Fuzzy Hash: AFE1D5B1D502599BDF10CFA4D884BDDB7B9AF08308F5489AAD509B7B00D7319A89CF93
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001DD0B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 140libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 1008 1dd0b0-1dd12f call 1e1510 GetModuleFileNameW PathRemoveFileSpecW PathAppendW 1012 1dd130-1dd139 1008->1012 1012->1012 1013 1dd13b-1dd15d call 1d5b40 call 1d1000 1012->1013 1018 1dd15f-1dd16f 1013->1018 1019 1dd194-1dd19d LoadLibraryW 1013->1019 1020 1dd17b-1dd193 call 1e1970 1018->1020 1021 1dd171-1dd176 1018->1021 1022 1dd19f-1dd1ad GetProcAddress 1019->1022 1023 1dd1e7-1dd1ed 1019->1023 1021->1020 1022->1023 1027 1dd1af-1dd1b8 1022->1027 1025 1dd1ef-1dd203 1023->1025 1026 1dd20b-1dd21b 1023->1026 1025->1026 1028 1dd21d-1dd222 1026->1028 1029 1dd227-1dd23f call 1e1970 1026->1029 1027->1023 1034 1dd1ba-1dd1c0 1027->1034 1028->1029 1034->1026 1037 1dd1c2-1dd1cc 1034->1037 1037->1023 1039 1dd1ce-1dd1dc 1037->1039 1041 1dd1de-1dd1e0 1039->1041 1042 1dd1e2 1039->1042 1041->1023 1042->1023
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DD0F4
                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000207), ref: 001DD107
                                                                                                                                                                                        • PathRemoveFileSpecW.SHLWAPI(?), ref: 001DD112
                                                                                                                                                                                        • PathAppendW.SHLWAPI(?,360Login.dll), ref: 001DD122
                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(?,?), ref: 001DD195
                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,LoginGetModuleW), ref: 001DD1A5
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FilePath$AddressAppendLibraryLoadModuleNameProcRemoveSpec_memset
                                                                                                                                                                                        • String ID: 360Login.dll$LoginGetModuleW
                                                                                                                                                                                        • API String ID: 4215116772-1645343665
                                                                                                                                                                                        • Opcode ID: 48e32029121de6f313a4464696d39b7c729dfeb34b1ff30d5f6a2627065ec13b
                                                                                                                                                                                        • Instruction ID: 7ea4dcfe7a018d72e3a683d4fec678088bbb7081ff3faf96eed2346d693c651a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 48e32029121de6f313a4464696d39b7c729dfeb34b1ff30d5f6a2627065ec13b
                                                                                                                                                                                        • Instruction Fuzzy Hash: DA415C752047029FD314DF68EC91EABB3E9FF88314F148A29E555C72A1EB30E945CB91
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C3D0160 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 1043 6c3d0160-6c3d017e 1044 6c3d02dd-6c3d02f4 call 6c3b8660 1043->1044 1045 6c3d0184-6c3d0187 1043->1045 1045->1044 1047 6c3d018d-6c3d01dd call 6c3bc210 SHGetValueA 1045->1047 1047->1044 1051 6c3d01e3-6c3d01ed 1047->1051 1052 6c3d01f0-6c3d01f5 1051->1052 1052->1052 1053 6c3d01f7-6c3d01fc 1052->1053 1053->1044 1054 6c3d0202-6c3d0214 1053->1054 1055 6c3d0216-6c3d021b 1054->1055 1056 6c3d021d-6c3d0222 1055->1056 1057 6c3d022e-6c3d0230 1055->1057 1056->1057 1058 6c3d0224-6c3d022a 1056->1058 1059 6c3d0233-6c3d024d 1057->1059 1060 6c3d0232 1057->1060 1058->1055 1061 6c3d022c 1058->1061 1062 6c3d0250-6c3d0258 1059->1062 1060->1059 1061->1060 1063 6c3d026b-6c3d026d 1062->1063 1064 6c3d025a-6c3d025f 1062->1064 1065 6c3d026f 1063->1065 1066 6c3d0270-6c3d02b4 call 6c3bc210 call 6c3cf350 lstrcmpiA 1063->1066 1064->1063 1067 6c3d0261-6c3d0267 1064->1067 1065->1066 1066->1044 1073 6c3d02b6-6c3d02dc call 6c3cf1f0 call 6c3b8660 1066->1073 1067->1062 1069 6c3d0269 1067->1069 1069->1065
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 6C3D01AC
                                                                                                                                                                                        • SHGetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,?,?,?,?,00000400), ref: 6C3D01D5
                                                                                                                                                                                        • _memset.LIBCMT ref: 6C3D0282
                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,?), ref: 6C3D02AA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: _memset$Valuelstrcmpi
                                                                                                                                                                                        • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                        • API String ID: 999496690-2395435937
                                                                                                                                                                                        • Opcode ID: f36a68fb098bddce63f5c774343961063c9b2680c29a4d599154cab622eca87c
                                                                                                                                                                                        • Instruction ID: f0e2078fb37b91ad24a2154a501996ac7bdf194d587abe32994640718911e76b
                                                                                                                                                                                        • Opcode Fuzzy Hash: f36a68fb098bddce63f5c774343961063c9b2680c29a4d599154cab622eca87c
                                                                                                                                                                                        • Instruction Fuzzy Hash: A8411532A097858FD725CB24C840BEB77E8AB85B0CF45491CE59A97941E732A50CCFA3
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C384C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 6C384C9A
                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,?,?,?,6C392797), ref: 6C384CA8
                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,?,?,?,6C392797), ref: 6C384CC9
                                                                                                                                                                                        • VerQueryValueW.VERSION(?,6C3FB750,?,?,?,00000000,00000000,?,?,?,?,?,6C392797), ref: 6C384CE6
                                                                                                                                                                                        • _memset.LIBCMT ref: 6C384CF7
                                                                                                                                                                                          • Part of subcall function 6C3850B0: _vswprintf_s.LIBCMT ref: 6C3850E6
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileInfoVersion_memset$QuerySizeValue_vswprintf_s
                                                                                                                                                                                        • String ID: %d.%d.%d.%d
                                                                                                                                                                                        • API String ID: 3774703460-3491811756
                                                                                                                                                                                        • Opcode ID: b07c8194ab0217ecd889d419875b95d74114d44b67305cb40d9bd6a2d6108bab
                                                                                                                                                                                        • Instruction ID: 01a54693f97beacc11b36d74a6699bb81834ad61b8ffa5549791f7d6ce732c57
                                                                                                                                                                                        • Opcode Fuzzy Hash: b07c8194ab0217ecd889d419875b95d74114d44b67305cb40d9bd6a2d6108bab
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C11B7B55042016EE614CB60DC55FBFB3ECEF94704F40881DFA85AAD91E738D5088B67
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001DC8B0 Relevance: 9.1, APIs: 6, Instructions: 80fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 001DBE80: _memset.LIBCMT ref: 001DBEAE
                                                                                                                                                                                          • Part of subcall function 001DBE80: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001DBED8
                                                                                                                                                                                        • PathFileExistsW.KERNELBASE(?), ref: 001DC8CD
                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 001DC8E9
                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 001DC8FD
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DC918
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001DC92A
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 001DC93C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Path_memset$CloseCreateExistsFolderHandleReadSize
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3529084245-0
                                                                                                                                                                                        • Opcode ID: 53906a57b6cae1cb638d545d5577c9eb93462c98b6904809f89a5ba4d4bf4f39
                                                                                                                                                                                        • Instruction ID: 2abdafd54b6aa239686fbd2cd8ae1595ebbb2f7715b16d724c3959b9bfae0eed
                                                                                                                                                                                        • Opcode Fuzzy Hash: 53906a57b6cae1cb638d545d5577c9eb93462c98b6904809f89a5ba4d4bf4f39
                                                                                                                                                                                        • Instruction Fuzzy Hash: A9210A711007027FD220AB25DC85FBF7BADEFD5720F144A19F51A56292EB31A445C6F1
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001D6D60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28stringCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 001D6D86
                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(00000104,00000104), ref: 001D6D98
                                                                                                                                                                                        • lstrcatW.KERNEL32(?,\Fonts\msyh.ttf), ref: 001D6DA8
                                                                                                                                                                                        • PathFileExistsW.KERNELBASE ref: 001D6DB2
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DirectoryExistsFilePathWindows_memsetlstrcat
                                                                                                                                                                                        • String ID: \Fonts\msyh.ttf
                                                                                                                                                                                        • API String ID: 2149854892-1699844292
                                                                                                                                                                                        • Opcode ID: c2b15f191407e90ed596e839797a589e47ad1a4e776498f3e46541adf988b5ff
                                                                                                                                                                                        • Instruction ID: 5002d0f0547f6e44886e3fe4eecd48c691d32d283e1e95afee09c19dd16ed3b9
                                                                                                                                                                                        • Opcode Fuzzy Hash: c2b15f191407e90ed596e839797a589e47ad1a4e776498f3e46541adf988b5ff
                                                                                                                                                                                        • Instruction Fuzzy Hash: C6F082F5504340BBC314EB60EC4ADAF77E4AF98700F418E1DB5AA821A2EB349048CB92
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C384A30 Relevance: 7.6, APIs: 5, Instructions: 70fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000000,00000000,?,?,?,?,?,?,6C358B2A), ref: 6C384A4B
                                                                                                                                                                                        • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,6C358B2A), ref: 6C384A5E
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,6C358B2A), ref: 6C384A6D
                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,6C358B2A), ref: 6C384AAD
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,6C358B2A), ref: 6C384ACD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$CloseHandle$CreateReadSize
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3664964396-0
                                                                                                                                                                                        • Opcode ID: 2c2304a68603d1b9b5189aafb8aef6ff0733a81c370eaa317a84f72fee55c451
                                                                                                                                                                                        • Instruction ID: 7a37a6dd1f06d00af3a6af8dbdf68b00fb0b673847c0f674086ae5a17f6fe846
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c2304a68603d1b9b5189aafb8aef6ff0733a81c370eaa317a84f72fee55c451
                                                                                                                                                                                        • Instruction Fuzzy Hash: 841124313012059FC344DF58CD88AAF77ADEBC5214F484A1EFC24DB640D73AE4098BA2
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C3B8E94 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • __lock.LIBCMT ref: 6C3B8EB2
                                                                                                                                                                                          • Part of subcall function 6C3C151F: __mtinitlocknum.LIBCMT ref: 6C3C1535
                                                                                                                                                                                          • Part of subcall function 6C3C151F: __amsg_exit.LIBCMT ref: 6C3C1541
                                                                                                                                                                                          • Part of subcall function 6C3C151F: EnterCriticalSection.KERNEL32(?,?,?,6C3C2097,00000004,6C403CE0,0000000C,6C3BEA00,00000000,?,00000000,00000000,00000000,?,6C3C0012,00000001), ref: 6C3C1549
                                                                                                                                                                                        • ___sbh_find_block.LIBCMT ref: 6C3B8EBD
                                                                                                                                                                                        • ___sbh_free_block.LIBCMT ref: 6C3B8ECC
                                                                                                                                                                                        • RtlFreeHeap.NTDLL(00000000,00000000,6C4037C8,0000000C,6C3C1500,00000000,6C403CC0,0000000C,6C3C153A,00000000,?,?,6C3C2097,00000004,6C403CE0,0000000C), ref: 6C3B8EFC
                                                                                                                                                                                        • GetLastError.KERNEL32(?,6C3C2097,00000004,6C403CE0,0000000C,6C3BEA00,00000000,?,00000000,00000000,00000000,?,6C3C0012,00000001,00000214), ref: 6C3B8F0D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2714421763-0
                                                                                                                                                                                        • Opcode ID: 627d9a50e23eb3543dc175ec606f511700d43467bb0546dd3b00d045b4a0a8ef
                                                                                                                                                                                        • Instruction ID: 0bd29aa79463a62ee64ce92e3fa7d59f2650ee0e1c7fa0714581a66b79518693
                                                                                                                                                                                        • Opcode Fuzzy Hash: 627d9a50e23eb3543dc175ec606f511700d43467bb0546dd3b00d045b4a0a8ef
                                                                                                                                                                                        • Instruction Fuzzy Hash: A001DB31A05306EAEF107BB5E808B8E3BB4AF2176CF10415AE4517BEC0CB3586448F97
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C34A790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNELBASE ref: 6C34A7B0
                                                                                                                                                                                        • DeviceIoControl.KERNEL32(00000000,0022204C,00000000,00000004,00000000,00000004,00000003,00000000), ref: 6C34A7E0
                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 6C34A7E9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                        • String ID: \\.\360SelfProtection
                                                                                                                                                                                        • API String ID: 33631002-936859468
                                                                                                                                                                                        • Opcode ID: 87971d0e34a66a9038e62082b1dc1eabb39b374aaf06a391f01f6ec9f263eeee
                                                                                                                                                                                        • Instruction ID: 2634f856ee1d14d9e41f7277c37dc17f930be29eeacae515c5588b9de34f6753
                                                                                                                                                                                        • Opcode Fuzzy Hash: 87971d0e34a66a9038e62082b1dc1eabb39b374aaf06a391f01f6ec9f263eeee
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7AF09C71394310BBE610E564FC0BFD736E8AB85B15F444A15F754D61C0D3B9960CC7A6
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001DBE80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _memset.LIBCMT ref: 001DBEAE
                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001DBED8
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FolderPath_memset
                                                                                                                                                                                        • String ID: %s\%s\loopinfo.xml$360Desktop
                                                                                                                                                                                        • API String ID: 3318179493-2372790096
                                                                                                                                                                                        • Opcode ID: b06cc1a28e9b27d537761648fb648bc8511db348a54cf8e5a36e563401edb5a3
                                                                                                                                                                                        • Instruction ID: ece3cf9f2197ac21209f9cdb824139b48f0e955d9a941462b89687af7a32e8e5
                                                                                                                                                                                        • Opcode Fuzzy Hash: b06cc1a28e9b27d537761648fb648bc8511db348a54cf8e5a36e563401edb5a3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 720186756543447BE314EB54DC06FBB73E4EFA4700F504A1CB5598B282EB70A54487D6
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C34EE40 Relevance: 6.1, APIs: 4, Instructions: 105COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,?,?,?,?,?,?,?,?,?,?,6C3EFBBC,000000FF), ref: 6C34EEB7
                                                                                                                                                                                        • _memset.LIBCMT ref: 6C34EF01
                                                                                                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C34EF12
                                                                                                                                                                                        • VerQueryValueW.VERSION(00000000,6C3FB750,?,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 6C34EF27
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileInfoVersion$QuerySizeValue_memset
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3017621270-0
                                                                                                                                                                                        • Opcode ID: aeb258ad82504e5ca7d30731c249e141fdf9d71fbc79f5a16cf4f6f8d138a5a9
                                                                                                                                                                                        • Instruction ID: 1ce325a4549a653ef693163abd9871bceffad8cfe2516a4cc67a16480bf46adf
                                                                                                                                                                                        • Opcode Fuzzy Hash: aeb258ad82504e5ca7d30731c249e141fdf9d71fbc79f5a16cf4f6f8d138a5a9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2D317971204B419BC304DB2CC841B5BB7E5FB86338F148B1DF4A99BAE0D7359506CBA5
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C3D6830 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • TlsFree.KERNELBASE(?), ref: 6C3D683C
                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 6C3D6849
                                                                                                                                                                                        • GetProcessHeap.KERNEL32 ref: 6C3D685E
                                                                                                                                                                                        • HeapFree.KERNEL32(00000000,00000000), ref: 6C3D686C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FreeHeap$CloseHandleProcess
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 54015191-0
                                                                                                                                                                                        • Opcode ID: f93c4991a6a8fd558093993ea13e82c542730bc27441cd8f89b17e40309ba66a
                                                                                                                                                                                        • Instruction ID: b5ebe55a69af39b634febb76a7598d16a93d79f38644baef2e713fb596420e77
                                                                                                                                                                                        • Opcode Fuzzy Hash: f93c4991a6a8fd558093993ea13e82c542730bc27441cd8f89b17e40309ba66a
                                                                                                                                                                                        • Instruction Fuzzy Hash: D3E022323043529BCA248B34DA0CB47BBFCAF02758F214C28F979C2580CB32F881CA20
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001EC784 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetEnvironmentStringsW.KERNEL32(00000000,001E399B), ref: 001EC787
                                                                                                                                                                                        • __malloc_crt.LIBCMT ref: 001EC7B5
                                                                                                                                                                                        • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001EC7C2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: EnvironmentStrings$Free__malloc_crt
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 237123855-0
                                                                                                                                                                                        • Opcode ID: 52cedda78be3a24fe4568ef4a234338f96241fcac1023409eed2f842bdfc8ee9
                                                                                                                                                                                        • Instruction ID: 085783d86fe1d2971b0900ce4d331c6d703f5df2c7d9383f09692be4ce78b6a7
                                                                                                                                                                                        • Opcode Fuzzy Hash: 52cedda78be3a24fe4568ef4a234338f96241fcac1023409eed2f842bdfc8ee9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 02F0A737E049E16F9B2576767C488BF2629DBDB3693174865F493C3140F7204D8386E0
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 6C3F0980 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 7libraryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(psapi.dll), ref: 6C3F0985
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2487474552.000000006C341000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C340000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2487436498.000000006C340000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487565254.000000006C3F2000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487673202.000000006C410000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487710349.000000006C413000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487747866.000000006C414000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C418000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2487810417.000000006C42B000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_6c340000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: LibraryLoad
                                                                                                                                                                                        • String ID: psapi.dll
                                                                                                                                                                                        • API String ID: 1029625771-80456845
                                                                                                                                                                                        • Opcode ID: b6fcd26022d910809e837819de3a140b73f1ec64432e9ff59a753be6e1575e41
                                                                                                                                                                                        • Instruction ID: 4775bba913a79fff69fb28867ee4b615989bb3d7ac98034a8639cc2e0e8f97e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: b6fcd26022d910809e837819de3a140b73f1ec64432e9ff59a753be6e1575e41
                                                                                                                                                                                        • Instruction Fuzzy Hash: 50B012F2D0020196CE056FB0682CC883A30E7413063200C9AE0B386E14CF39C081AF85
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001E99BB Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • ___crtCorExitProcess.LIBCMT ref: 001E99C3
                                                                                                                                                                                          • Part of subcall function 001E9990: GetModuleHandleW.KERNEL32(mscoree.dll,?,001E99C8,?,?,001E617F,000000FF,0000001E,001FA330,0000000C,001E622B,?,?,?,001EE303,00000004), ref: 001E999A
                                                                                                                                                                                          • Part of subcall function 001E9990: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001E99AA
                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 001E99CC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2427264223-0
                                                                                                                                                                                        • Opcode ID: 840c88d5a5608b218aa45510ad589e691e7240914693b5e4db15e1b1aa790622
                                                                                                                                                                                        • Instruction ID: f4bf3bb0687f4fbc4aece7203fdc764d6a80ee7670feed0172047224d6e61fd4
                                                                                                                                                                                        • Opcode Fuzzy Hash: 840c88d5a5608b218aa45510ad589e691e7240914693b5e4db15e1b1aa790622
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5BB09231000648BBCB012F12DC0A89E3F2AEB803A4B144024FA180A072DF72ADD2DA88
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001E6064 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 001E6079
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: 3e4aee4bc0849d8a5de7bfa451bffcebea2726612e99b2b0ca469eb9a900c60f
                                                                                                                                                                                        • Instruction ID: 1750e06aa2df08ccf124897e21c8b1a1a5d6545fdd8db442676e9cebb12715ae
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e4aee4bc0849d8a5de7bfa451bffcebea2726612e99b2b0ca469eb9a900c60f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7BD05E32958349AEEB109F71BC087363BDCA7843A9F004435F80CC6590F770D580D500
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001E3668 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __waccess_s
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4272103461-0
                                                                                                                                                                                        • Opcode ID: 121c4f77d4c72d3789264fc0d0d617dc9724d87233f222cead199be475d85574
                                                                                                                                                                                        • Instruction ID: 3ab2d82a048963e62f19109cb3594a93a1cdec615275a12f83aec4581d3a22c3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 121c4f77d4c72d3789264fc0d0d617dc9724d87233f222cead199be475d85574
                                                                                                                                                                                        • Instruction Fuzzy Hash: F2C02B3300400C3F8F041DE6EC04C093F09CE803307104111F81C8A490CE32DA114140
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001E9BD7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • _doexit.LIBCMT ref: 001E9BE3
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __lock.LIBCMT ref: 001E9AB9
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __decode_pointer.LIBCMT ref: 001E9AF0
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __decode_pointer.LIBCMT ref: 001E9B05
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __decode_pointer.LIBCMT ref: 001E9B2F
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __decode_pointer.LIBCMT ref: 001E9B45
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __decode_pointer.LIBCMT ref: 001E9B52
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __initterm.LIBCMT ref: 001E9B81
                                                                                                                                                                                          • Part of subcall function 001E9AAB: __initterm.LIBCMT ref: 001E9B91
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1597249276-0
                                                                                                                                                                                        • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                        • Instruction ID: 2b5ede8d586a68befca7bed6605581933292000f400853ef152ade5360ae3988
                                                                                                                                                                                        • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2CB0923258024833EA202542AC03F4A3A098BD0BA0E244020BA0C1A1A5AAA3A9618189
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                        Function 001D1335 Relevance: 1.3, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 001D134E
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000010.00000002.2486059908.00000000001D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 001D0000, based on PE: true
                                                                                                                                                                                        • Associated: 00000010.00000002.2486027669.00000000001D0000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486101694.00000000001F4000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486136278.00000000001FC000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        • Associated: 00000010.00000002.2486183746.0000000000208000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_16_2_1d0000_flashApp.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FreeVirtual
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1263568516-0
                                                                                                                                                                                        • Opcode ID: 9745f8ea412eb462745d6338ce0a1e3220d339dca1494fba61ad3dec1ba4b83a
                                                                                                                                                                                        • Instruction ID: 5cf0c08c73196206b8d51fc8c3c3912987eb00a6637c80803288dc1f6f635b4d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9745f8ea412eb462745d6338ce0a1e3220d339dca1494fba61ad3dec1ba4b83a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 68E01A72B44748ABDB28DFA5E8827ADB374FB48721F20016AEA16677C1DB3528048A54
                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                        Uniqueness Score: -1.00%